7.5

CVE-2024-28340

Exploit
An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netgear ≫ Cbk40 Firmware Version 2.5.0.28
   Netgear ≫ Cbk40 Version -
Netgear ≫ Cbk43 Firmware Version 2.5.0.28
   Netgear ≫ Cbk43 Version -
Netgear ≫ Cbr40 Firmware Version 2.5.0.28
   Netgear ≫ Cbr40 Version -
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.64% 0.456
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://www.netgear.com/about/security/
Vendor Advisory
https://github.com/funny-mud-peee/IoT-vuls/blob/main/Netgear%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88currentsetting.htm%EF%BC%89.md
Third Party Advisory
Exploit