ISE SOHO Vulnerability Catalog Published - Independent Security ...

Vulnerability: Information Disclosure
CVE: CVE-2013-3070
Description
The Netgear WNDR4700 router is susceptible to an unauthenticated information
disclosure. An attacker can send HTTP requests to the router to retrieve the WLAN SSID
and accompanying PSK.
Attack Requirements
♦ The attacker must have the ability to send a HTTP request to the routers web
management portal.
♦ Authentication is not required for exploitation.
Details
♦ Other firmware versions may be vulnerable.
Impact
If an unauthenticated remote attacker has access to the management portal of a
WNDR4700 router, the attacker can make a single HTTP request to gain the necessary
information to access the routers WLAN.
Recommendations to the Vendor
♦ Once the router is setup, prohibit access to router wizard setup pages.
♦ Additional information for vendors regarding immediate and long term fixes for
these issues can be found here: http://www.securityevaluators.com/content/casestudies/routers/#recommendationsVendors
Solution
♦ There currently is not a solution to this problem.
Proof of Concept Exploit
Make a HTTP GET request to the following URL retrieve the current SSID and PSK for
the affected WNDR4700 router:
♦ http://x.x.x.x/BRS_success.html
Disclosure Timeline
♦ 2/25/2013 - Notified Netgear
♦ 4/15/2013 - Public Disclosure
34