Sign-up

ID

VAR-202002-0041


CVE

CVE-2012-6340


TITLE

NETGEAR WGR614 v7 and v9 Authentication vulnerabilities in

Trust: 0.8

sources: JVNDB: JVNDB-2012-006603

DESCRIPTION

An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issue to CVE-2006-1002. This vulnerability is CVE-2006-1002 Vulnerability related to.Information may be obtained. I've been reverse engineering the Netgear WGR614 wireless router, which has been one of the most popular devices shipped by major ISPs in the UK over the last ten years. After disassembling the device and identifying the components, I noticed that the firmware and all settings are stored on a single EEPROM (flash) chip, specifically a Macronix MX25L1605 SPI 16Mbit EEPROM. Other variants of the device may use slightly different chips, but they all seem to use SPI EEPROMs with identical I/O commands. I de-soldered the IC and hooked it up to a BusPirate, and used it to extract the entire contents of the chip. I quickly discovered two interesting things: First, I found a hard-coded credential used for direct serial programming. Using it requires direct physical access and you have to solder wires onto the board. Despite this not being particularly interesting, this issue has been assigned as CVE-2012-6340 anyway. It's always good to have the information out there. Second, I noticed that there were multiple copies of my config file, and all passwords (for both control panel and wifi) within them are plain-text. It turns out that, in order to prevent config file corruption, the router re-generates the entire config file and writes a new copy directly after the previous one. It then activates the new config, and soft-deletes the old file by removing its entry from a list. Once you've changed the config several times (about 11 on this device), it hits the end of the flash chip's storage and cycles back to the original address. However, it does not actually wipe the old config files. This issue, assigned CVE-2012-6341, results in the ability to recover all previously used passwords on the device, for both the control panel and WEP/WPA/WPA2, in plaintext. A factory reset does not fix this; it simply restores a default config file onto the lower address. As such, an attacker who steals the device may recover the last-used passwords and config, as well as many previous passwords and configuration data. There also seems to be some storage of DHCP client information, but the data I have is inconclusive due to it being partially overwritten. This has been confirmed on the WGR614v7 and WGR614v9 models, and is expected to be the case on all other revisions. It also looks like the WGR624 model has the same design, so other models in the same series may be affected too

Trust: 1.8

sources: NVD: CVE-2012-6340 // JVNDB: JVNDB-2012-006603 // VULMON: CVE-2012-6340 // PACKETSTORM: 118854

AFFECTED PRODUCTS

vendor:netgearmodel:wgr614v9scope:eqversion: -

Trust: 1.0

vendor:netgearmodel:wgr614v7scope:eqversion: -

Trust: 1.0

vendor:netgearmodel:wgr614v7scope: - version: -

Trust: 0.8

vendor:netgearmodel:wgr614v9scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2012-006603 // NVD: CVE-2012-6340

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-6340
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2012-006603
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202002-182
value: MEDIUM

Trust: 0.6

VULMON: CVE-2012-6340
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2012-6340
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2012-006603
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

nvd@nist.gov: CVE-2012-6340
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 0.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2012-006603
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2012-6340 // JVNDB: JVNDB-2012-006603 // CNNVD: CNNVD-202002-182 // NVD: CVE-2012-6340

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.8

sources: JVNDB: JVNDB-2012-006603 // NVD: CVE-2012-6340

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202002-182

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-006603

PATCH
title:WGR614v9 - 54 Mbps Wireless Routerurl:https://www.netgear.com/support/product/WGR614v9.aspx
Trust: 0.8
title:WGR614v7 - 54 Mbps Wireless Routerurl:https://www.jp.netgear.com/support/product/WGR614v7.aspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-006603

EXTERNAL IDS
db:NVDid:CVE-2012-6340
Trust: 2.6
db:VULDBid:7180
Trust: 2.5
db:PACKETSTORMid:118854
Trust: 1.8
db:JVNDBid:JVNDB-2012-006603
Trust: 0.8
db:CNNVDid:CNNVD-202002-182
Trust: 0.6
db:VULMONid:CVE-2012-6340
Trust: 0.1
sources:
            
            
            VULMON: CVE-2012-6340 // 
            
            
            
            JVNDB: JVNDB-2012-006603 // 
            
            
            
            PACKETSTORM: 118854 // 
            
            
            
            CNNVD: CNNVD-202002-182 // 
            
            
            
            NVD: CVE-2012-6340

REFERENCES
url:https://vuldb.com/?id.7180
Trust: 2.5
url:https://packetstormsecurity.com/files/118854/netgear-wgr614-credential-information.html
Trust: 1.7
url:https://www.securityfocus.com/archive/1/525042
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2012-6340
Trust: 1.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-6340
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/287.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-6341
Trust: 0.1
sources:
            
            
            VULMON: CVE-2012-6340 // 
            
            
            
            JVNDB: JVNDB-2012-006603 // 
            
            
            
            PACKETSTORM: 118854 // 
            
            
            
            CNNVD: CNNVD-202002-182 // 
            
            
            
            NVD: CVE-2012-6340

CREDITS
Graham Sutherland
Trust: 0.1
sources:
            
            
            PACKETSTORM: 118854

SOURCES
db:VULMONid:CVE-2012-6340
db:JVNDBid:JVNDB-2012-006603
db:PACKETSTORMid:118854
db:CNNVDid:CNNVD-202002-182
db:NVDid:CVE-2012-6340

LAST UPDATE DATE
2024-08-14T13:44:25.552000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2012-6340date:2020-02-11T00:00:00
db:JVNDBid:JVNDB-2012-006603date:2020-02-25T00:00:00
db:CNNVDid:CNNVD-202002-182date:2021-01-05T00:00:00
db:NVDid:CVE-2012-6340date:2020-02-11T18:33:08.280

SOURCES RELEASE DATE
db:VULMONid:CVE-2012-6340date:2020-02-06T00:00:00
db:JVNDBid:JVNDB-2012-006603date:2020-02-25T00:00:00
db:PACKETSTORMid:118854date:2012-12-14T23:54:44
db:CNNVDid:CNNVD-202002-182date:2020-02-06T00:00:00
db:NVDid:CVE-2012-6340date:2020-02-06T18:15:13.260