CVE-2016-10175

The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain the administrator username and password, when used in combination with the CVE-2016-10176 vulnerability that allows resetting the answers to the password-recovery questions.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

64.98% chance of exploitation in the next 30 days, 99th percentile

Published

2017-01-30

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://seclists.org/fulldisclosure/2016/Dec/72
• https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/40949

References

• CVE Record
• NVD entry

Related

• CVE-2016-10174
• CVE-2016-10176
• CVE-2016-10173
• CVE-2016-10177
• CVE-2016-10156
• CVE-2016-10178