ZDI-19-866: NETGEAR AC1200 mini_httpd Poison Null Byte Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings. By inserting a null byte into the path, the user can skip most authentication checks. An attacker can leverage this vulnerability to bypass authentication on the system.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NETGEAR AC1200 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-19-866?
The severity of ZDI-19-866 is considered high due to the ability for network-adjacent attackers to bypass authentication.
How do I fix ZDI-19-866?
To fix ZDI-19-866, ensure that you update the NETGEAR AC1200 Smart WiFi Router to the latest firmware provided by the vendor.
Who is affected by ZDI-19-866?
Users of the NETGEAR AC1200 Smart WiFi Router are affected by ZDI-19-866.
Can ZDI-19-866 be exploited remotely?
ZDI-19-866 requires network-adjacent access, meaning the attacker needs to be on the same local network to exploit it.
What type of attacks can ZDI-19-866 facilitate?
ZDI-19-866 can facilitate unauthorized access to devices, allowing attackers to bypass authentication and potentially gain control.
- agent/type
- agent/softwarecombine
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-19-866
- alias/ZDI-CAN-8616
- alias/CVE-2019-17137
- agent/software-canonical-lookup
- agent/title
- agent/references
- agent/severity
- agent/description
- agent/tags
- agent/event
- agent/source
- vendor/netgear
- canonical/netgear ac1200