CVE-2016-11014: NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case

Critical severity · published Oct 16, 2019

CVE-2016-11014

NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case

9.8

CVSS

2.5%

EPSS

On KEV

Description

NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.5% · higher than 85% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Jnr1010 Firmware · Netgear

before 1.0.0.32 · source: NVD

Affected product

Jnr1010 Firmware

Netgear

All Jnr1010 Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-11014

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-11014

Exploit

https://cybersecurityworks.com/zerodays/cve-2016-11014-netgear.html

Exploit

https://github.com/cybersecurityworks/Disclosed/issues/14

Exploit

https://khalil-shreateh.com/khalil.shtml/it-highlights/593-Netgear-1.0.0.24-Bypass---Improper-Session-Management--.html

Exploit

https://lists.openwall.net/full-disclosure/2016/01/11/5

Exploit

https://packetstormsecurity.com/files/135216/Netgear-1.0.0.24-Bypass-Improper-Session-Management.html