CVE DatabaseCVE-2017-5521

Updated 2026-06-17한국어 권고문 →

CVE-2017-55218.1/HIGHCISA KEV

NETGEAR Routers Administrator Password Disclosure Vulnerability (CVE-2017-5521)

⚡ Jump to Patch

Affected Vendors

netgear

Affected Components

r8500, r8300, r7000, r6400, r7300, r7100lg, r6300v2, wndr3400v3, wnr3500lv2, r6250, r6700, r6900, r8000

Published Date

2017-01-17

CVSS v3.1

8.1

HIGH

EPSS (30d)

89.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Multiple NETGEAR router models including R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000

Impact

Unauthenticated remote attackers (if remote management is enabled) or local attackers on LAN/WLAN can retrieve the plaintext administrator password

Mitigation

Apply the latest official firmware updates immediately, or enable the 'Password Recovery' feature and disable remote management as a temporary workaround

Affected Products & Version Scope

NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 routers (vulnerable when password recovery is disabled)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Download the latest firmware patch corresponding to your router model from the official NETGEAR Support portal. You can manually upload the firmware via the Web GUI or use a command-line utility like curl if supported by your device's management API.

bash

# Download the appropriate firmware (.chk or .bin) from NETGEAR Support
# Upload the firmware file to the router's upgrade endpoint
curl -X POST -F 'configUpload=@NETGEAR_firmware_v1.0.x.chk' http://192.168.1.1/upgrade.cgi

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, log in to the router's web interface and enable the 'Password Recovery' feature. This forces the router to prompt for security questions, effectively blocking the exploit. Additionally, disable the 'Remote Management' option to prevent WAN-side exploitation.

bash

# Example iptables rules to block external WAN access to the web admin interface
iptables -A INPUT -p tcp -i eth0 --dport 80 -j DROP
iptables -A INPUT -p tcp -i eth0 --dport 443 -j DROP

3. Log Audit & IoC Verification Commands

Inspect network traffic or web server access logs for unauthorized requests targeting the password recovery CGI script.

bash

# Search web server access logs for exploitation attempts targeting the CGI script
grep -i 'passwordrecovered.cgi' /var/log/httpd_access.log

# Identify IP addresses that triggered 401 Unauthorized responses followed by CGI access
awk '/401/ {print $1}' /var/log/httpd_access.log | sort | uniq

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Immediately disable remote management on vulnerable NETGEAR routers, enable the 'Password Recovery' feature, and apply the latest firmware updates.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-5521) exists in the web management server of various NETGEAR routers due to a flaw in the password recovery mechanism. When a user attempts to access the web management panel and cancels the HTTP basic authentication prompt, the server redirects the user to a password recovery page if the 'Password Recovery' feature is not enabled. This redirection page inadvertently exposes a sensitive password recovery token.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by performing the following steps:

The attacker accesses the router's web management interface and cancels the authentication prompt.
If password recovery is disabled, the router redirects the client to a page containing a unique recovery token.
The attacker extracts this token and sends a crafted GET request to /passwordrecovered.cgi?id=TOKEN.
The web server validates the token and returns the plaintext administrator password directly in the HTTP response.

3. Infrastructure & Business Impact

As a vulnerability listed in the CISA KEV catalog, this flaw has been actively exploited in the wild. Successful exploitation grants full administrative control over the router. Attackers can modify DNS settings to redirect corporate traffic, deploy malicious firmware, or recruit the compromised routers into IoT botnets, posing a severe threat to both enterprise and home network environments.

Official Vendor Advisories & References

NVD Original English Description

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.

http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability

Source: cve@mitre.org · Vendor Advisory

http://www.securityfocus.com/bid/95457

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/41205/

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

http://www.securityfocus.com/bid/95457

Source: af854a3a-2127-422b-91ae-364da2661108 · Broken Link, Third Party Advisory, VDB Entry

https://www.exploit-db.com/exploits/41205/

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

Frequently Asked SecOps Questions (CVE-2017-5521)

FAQ

Q1. How critical is CVE-2017-5521 and is it actively exploited in the wild?

CVE-2017-5521 is rated CVSS 8.1 (HIGH) with a 30-day EPSS exploitation probability of 89.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2017-5521?

Primary impacted vendors include netgear across r8500, r8300, r7000, r6400, r7300, r7100lg, r6300v2, wndr3400v3, wnr3500lv2, r6250, r6700, r6900, r8000. Scope summary: NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 routers (vulnerable when password recovery is disabled)

Q3. What temporary mitigations or workarounds exist for CVE-2017-5521 before patching?

[Mitigation] Apply the latest official firmware updates immediately, or enable the 'Password Recovery' feature and disable remote management as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION