What’s Vulnerable › Vulnerabilities

CVE-2019-17373

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-10-09 · updated 2026-06-17

Description

Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL. This affects MBR1515, MBR1516, DGN2200, DGN2200M, DGND3700, WNR2000v2, WNDR3300, WNDR3400, WNR3500, and WNR834Bv2.

Affected products

• NETGEAR Dgn2200 Firmware: all versions
• NETGEAR Dgn2200M Firmware: all versions
• Netgear DGND3700: all versions
• NETGEAR Mbr1515 Firmware: all versions
• NETGEAR Mbr1516 Firmware: all versions
• NETGEAR Wndr3300 Firmware: all versions
• NETGEAR Wndr3400 Firmware: all versions
• NETGEAR Wnr2000V2 Firmware: all versions
• NETGEAR Wnr3500 Firmware: all versions
• NETGEAR Wnr834Bv2 Firmware: all versions

References

• https://github.com/zer0yu/CVE_Request/blob/master/netgear/Netgear_web_interface_exists_authentication_bypass.md
• https://github.com/zer0yu/CVE_Request/blob/master/netgear/Netgear_web_interface_exists_authentication_bypass.md

Get alerted when CVE-2019-17373 or the next vulnerability affects your stack