NETGEAR WiFi Range Extenders Path Traversal Vulnerability

A path traversal vulnerability exists in NETGEAR WiFi range extenders, allowing an attacker with LAN authentication to access the router's IP and view the contents of a dynamically generated webproc file. This file records the usernames and passwords submitted through the router's graphical user interface.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, specifically usernames and passwords entered in the router's GUI, by allowing access to the webproc file where this information is recorded.

Remediation

Users are advised to manually check the firmware version and update to the latest version. The vulnerability is fixed in EX2800, EX3110, EX5000, and EX6110 range extenders in firmware version 1.0.1.82 or later.