ZDI-21-1058: NETGEAR XR1000 UPnP SOAPAction Missing Authentication Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack of authentication required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-21-1058?
The severity of ZDI-21-1058 is considered high due to its potential to allow unauthorized access to sensitive information.
How do I fix ZDI-21-1058?
To fix ZDI-21-1058, update your NETGEAR XR1000 router firmware to the latest version provided by NETGEAR.
What type of attack is associated with ZDI-21-1058?
ZDI-21-1058 is associated with network-adjacent attacks that exploit vulnerabilities in SOAP message processing.
Is authentication required to exploit ZDI-21-1058?
No, authentication is not required to exploit ZDI-21-1058, making it particularly dangerous.
Which product is affected by ZDI-21-1058?
The affected product of ZDI-21-1058 is the NETGEAR XR1000 router.