CVE-2017-5521

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.894 · 100 %ileexploit · functionalEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 2 exploits · functional

Likely / severe?

89.4% (100th) EPSS

CVSS 4.3 · medium

Is it mine?

46 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

added 2022-09-08remediate by 2022-09-29

required action Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.

EPSS · scored 2026-10-27

NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–8.1

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 5.9

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 2.2 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200US

exploits (2)

Public proof-of-concept and weaponised exploit code.

EDB-41205Netgear Routers - Password Disclosurefunctional · exploit_db
auxiliary/gather/netgear_password_disclosureNETGEAR Administrator Password Disclosurefunctional · metasploit

affected products (46)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
NETGEAR AC1450≤ 1.0.0.34_10.0.16fstec_bduRU
NETGEAR C6300≤ 2.01.18fstec_bduRU
NETGEAR D6220≤ 1.0.0.22fstec_bduRU
NETGEAR D6300≤ 1.0.0.96fstec_bduRU
NETGEAR D6300B≤ 1.0.0.40fstec_bduRU
NETGEAR D6400≤ 1.0.0.56fstec_bduRU
NETGEAR DGN2200Bv4≤ 1.0.0.68fstec_bduRU
NETGEAR DGN2200v4≤ 1.0.0.76fstec_bduRU
NETGEAR R6200≤ 1.0.1.56_1.0.43fstec_bduRU
NETGEAR R6200v2≤ 1.0.3.12fstec_bduRU
NETGEAR R6250≤ 1.0.4.8fstec_bduRU
NETGEAR R6300≤ 1.0.2.78_1.0.58fstec_bduRU
NETGEAR R6300v2≤ 1.0.4.6fstec_bduRU
NETGEAR R6400≤ 1.0.1.18fstec_bduRU
NETGEAR R6700≤ 1.0.1.16fstec_bduRU
NETGEAR R6900≤ 1.0.1.16fstec_bduRU
NETGEAR R7000≤ 1.0.7.6fstec_bduRU
NETGEAR R7100LG≤ 1.0.0.28fstec_bduRU
NETGEAR R7300DST≤ 1.0.0.46fstec_bduRU

showing 20 of 46

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2017-01-17modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability cnnvd
http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability enisa_euvd
http://www.securityfocus.com/bid/95457 enisa_euvd
https://www.exploit-db.com/exploits/41205/enisa_euvd
http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-VulnerabilityVendor Advisorynvd
http://www.securityfocus.com/bid/95457Broken LinkThird Party AdvisoryVDB Entrynvd
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5521US Government Resourcenvd
https://www.exploit-db.com/exploits/41205/ExploitThird Party AdvisoryVDB Entrynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan