ZDI-21-1058: NETGEAR XR1000 UPnP SOAPAction Missing Authentication Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack of authentication required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NETGEAR XR1000 firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-21-1058?
The severity of ZDI-21-1058 is considered high due to its potential to allow unauthorized access to sensitive information.
How do I fix ZDI-21-1058?
To fix ZDI-21-1058, update your NETGEAR XR1000 router firmware to the latest version provided by NETGEAR.
What type of attack is associated with ZDI-21-1058?
ZDI-21-1058 is associated with network-adjacent attacks that exploit vulnerabilities in SOAP message processing.
Is authentication required to exploit ZDI-21-1058?
No, authentication is not required to exploit ZDI-21-1058, making it particularly dangerous.
Which product is affected by ZDI-21-1058?
The affected product of ZDI-21-1058 is the NETGEAR XR1000 router.
- agent/references
- agent/softwarecombine
- agent/type
- agent/severity
- agent/title
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-1058
- alias/ZDI-CAN-13325
- alias/CVE-2021-34870
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/netgear
- canonical/netgear xr1000 firmware