Netgear C7800 Router Administrative Interface Cleartext Credential Transmission Vulnerability

A vulnerability exists in the administrative web interface of the Netgear C7800 router, specifically in firmware version 6.01.07, and potentially other versions. The router uses basic authentication, sending usernames and passwords encoded in base64 within an HTTP header. Compounding this issue, the web server does not enforce transport security by default, leaving administrative credentials exposed to interception during authenticated requests over Wi-Fi or a local area network, especially if an attacker can execute a man-in-the-middle attack.

Impact

Exploitation of this vulnerability allows for the interception of administrative credentials, which could be used to gain unauthorized access to the router's administrative interface.