High severity · published Mar 12, 2024
CVE-2024-28340
An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive…
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cbk40 Firmware · Netgear
2.5.0.28 · source: NVD
CF
Cbk43 Firmware · Netgear
2.5.0.28 · source: NVD
CF
Cbr40 Firmware · Netgear
2.5.0.28 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28340
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28340
Exploit
https://github.com/funny-mud-peee/IoT-vuls/blob/main/Netgear%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88currentsetting.htm%EF%BC%89.md
Vendor Advisory
https://www.netgear.com/about/security/
More from Cbk40 Firmware
9.8
CVE-2020-35795
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker
9.4
CVE-2020-35800
Certain NETGEAR devices are affected by incorrect configuration of security settings
8.8
CVE-2020-27861
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers
5.4
CVE-2024-28339
An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information…