Sign-up

ID

VAR-202002-0042


CVE

CVE-2012-6341


TITLE

NEtGEAR WGR614 v7 and v9 Vulnerability regarding information leakage in

Trust: 0.8

sources: JVNDB: JVNDB-2012-006620

DESCRIPTION

An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover all previously used passwords on the device, for both the control panel and WEP/WPA/WPA2, in plaintext. This is a different issue than CVE-2012-6340. NEtGEAR WGR614 v7 and v9 There is an information leakage vulnerability in. I've been reverse engineering the Netgear WGR614 wireless router, which has been one of the most popular devices shipped by major ISPs in the UK over the last ten years. After disassembling the device and identifying the components, I noticed that the firmware and all settings are stored on a single EEPROM (flash) chip, specifically a Macronix MX25L1605 SPI 16Mbit EEPROM. Other variants of the device may use slightly different chips, but they all seem to use SPI EEPROMs with identical I/O commands. I de-soldered the IC and hooked it up to a BusPirate, and used it to extract the entire contents of the chip. I quickly discovered two interesting things: First, I found a hard-coded credential used for direct serial programming. Using it requires direct physical access and you have to solder wires onto the board. Despite this not being particularly interesting, this issue has been assigned as CVE-2012-6340 anyway. It's always good to have the information out there. Second, I noticed that there were multiple copies of my config file, and all passwords (for both control panel and wifi) within them are plain-text. It turns out that, in order to prevent config file corruption, the router re-generates the entire config file and writes a new copy directly after the previous one. It then activates the new config, and soft-deletes the old file by removing its entry from a list. Once you've changed the config several times (about 11 on this device), it hits the end of the flash chip's storage and cycles back to the original address. However, it does not actually wipe the old config files. A factory reset does not fix this; it simply restores a default config file onto the lower address. As such, an attacker who steals the device may recover the last-used passwords and config, as well as many previous passwords and configuration data. There also seems to be some storage of DHCP client information, but the data I have is inconclusive due to it being partially overwritten. This has been confirmed on the WGR614v7 and WGR614v9 models, and is expected to be the case on all other revisions. It also looks like the WGR624 model has the same design, so other models in the same series may be affected too

Trust: 1.71

sources: NVD: CVE-2012-6341 // JVNDB: JVNDB-2012-006620 // PACKETSTORM: 118854

AFFECTED PRODUCTS

vendor:netgearmodel:wgr614v9scope:eqversion: -

Trust: 1.0

vendor:netgearmodel:wgr614v7scope:eqversion: -

Trust: 1.0

vendor:netgearmodel:wgr614v7scope: - version: -

Trust: 0.8

vendor:netgearmodel:wgr614v9scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2012-006620 // NVD: CVE-2012-6341

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-6341
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2012-006620
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202002-189
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2012-6341
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2012-006620
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

nvd@nist.gov: CVE-2012-6341
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2012-006620
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2012-006620 // CNNVD: CNNVD-202002-189 // NVD: CVE-2012-6341

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2012-006620 // NVD: CVE-2012-6341

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202002-189

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202002-189

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-006620

PATCH
title:WGR614v9 - 54 Mbps Wireless Routerurl:https://www.netgear.com/support/product/WGR614v9.aspx
Trust: 0.8
title:WGR614v7 - 54 Mbps Wireless Routerurl:https://www.jp.netgear.com/support/product/WGR614v7.aspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2012-006620

EXTERNAL IDS
db:NVDid:CVE-2012-6341
Trust: 2.5
db:JVNDBid:JVNDB-2012-006620
Trust: 0.8
db:CNNVDid:CNNVD-202002-189
Trust: 0.6
db:PACKETSTORMid:118854
Trust: 0.1
sources:
            
            
            JVNDB: JVNDB-2012-006620 // 
            
            
            
            PACKETSTORM: 118854 // 
            
            
            
            CNNVD: CNNVD-202002-189 // 
            
            
            
            NVD: CVE-2012-6341

REFERENCES
url:https://www.securityfocus.com/archive/1/525042
Trust: 2.4
url:https://packetstormsecurity.com/files/date/2012-12-14/
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2012-6341
Trust: 1.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-6341
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2012-6340
Trust: 0.1
sources:
            
            
            JVNDB: JVNDB-2012-006620 // 
            
            
            
            PACKETSTORM: 118854 // 
            
            
            
            CNNVD: CNNVD-202002-189 // 
            
            
            
            NVD: CVE-2012-6341

CREDITS
Graham Sutherland
Trust: 0.1
sources:
            
            
            PACKETSTORM: 118854

SOURCES
db:JVNDBid:JVNDB-2012-006620
db:PACKETSTORMid:118854
db:CNNVDid:CNNVD-202002-189
db:NVDid:CVE-2012-6341

LAST UPDATE DATE
2024-08-14T13:44:25.587000+00:00

SOURCES UPDATE DATE
db:JVNDBid:JVNDB-2012-006620date:2020-02-28T00:00:00
db:CNNVDid:CNNVD-202002-189date:2021-07-14T00:00:00
db:NVDid:CVE-2012-6341date:2020-02-12T16:15:41.817

SOURCES RELEASE DATE
db:JVNDBid:JVNDB-2012-006620date:2020-02-28T00:00:00
db:PACKETSTORMid:118854date:2012-12-14T23:54:44
db:CNNVDid:CNNVD-202002-189date:2020-02-06T00:00:00
db:NVDid:CVE-2012-6341date:2020-02-06T19:15:10.820