The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows re

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netgear d3600 firmware1.0.0.49
• netgear d6000 firmwareup to 1.0.0.49 inclusive

Other highest-scoring records for the same primary product.

• CVE-2020-35799Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
  39Monitor
• CVE-2018-21137Certain NETGEAR devices are affected by a hardcoded password.
  39Monitor
• CVE-2019-20730Certain NETGEAR devices are affected by SQL injection.
  39Monitor
• CVE-2017-18762Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
  36Monitor
• CVE-2021-45641Certain NETGEAR devices are affected by incorrect configuration of security settings.
  35Monitor
• CVE-2018-21224Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.