CVE-2016-5649

Netgear DGN2200 and DGND3700 disclose the administrator password

Published: Jul 24, 2018Updated: Nov 21, 2024 Sources: CVE List NVDCWE-319

9.8CRITICAL

Description

A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.

In plain language

AI Worth attention

If you use a Netgear DGN2200 or DGND3700, an attacker may be able to view the router’s administrator password over the network and take over the web admin page; you should update your firmware now if your router is reachable from the internet.

Executive summary

CVE-2016-5649 affects Netgear DGN2200 and DGND3700 firmware where a remotely reachable web page discloses the administrator password in clear text, enabling an attacker to log in as an administrator via the router’s web interface.

If affected, business impact

Full router admin takeoverTraffic redirection/man-in-the-middleService disruptionCredential compromise risk

What to do now

Check your router model and current firmware version in the router’s web interface (look for the firmware version for DGN2200 or DGND3700).
If you have affected firmware, upgrade to the vendor-fixed firmware: DGN2200 to 1.0.0.52 and DGND3700 to 1.0.0.28.
After updating, change the router’s administrator password to a new, strong password.
If your router is exposed to the internet, verify any “remote management”/WAN administration settings are disabled, so the router’s admin interface can’t be reached externally.

Some work to apply

What is it

This bug can accidentally “show” the router’s administrator password to someone who reaches a particular page on the router. It’s like leaving the key to a locked office taped to the door—then using that key to enter the office and change settings.

Who is affected

This matters if your small business uses a Netgear DGN2200 or DGND3700 router that is running affected firmware. The risk is specifically tied to an attacker reaching the exposed router page without authentication, so it’s most concerning when the router is reachable from the internet (for example, if remote/WAN administration is enabled).

How urgent is it

This is an attacker-friendly issue with a public exploit available, meaning real-world misuse is practical. Because the password can be exposed in clear text, you should treat this as a high-priority patch (amber) if the router could be accessed from outside your network.

What to do — in detail

Confirm exposure (quick checks)
- Identify every device in your business network that is a Netgear DGN2200 or DGND3700.
- In each router’s web interface, note the firmware version.
- Compare to the vendor-fixed versions referenced by the patch information.
Upgrade to the fixed firmware
- For DGN2200: upgrade to firmware version 1.0.0.52.
- For DGND3700: upgrade to firmware version 1.0.0.28.
- Plan for a reboot during the firmware upgrade.
Reset/rotate credentials after patching
- After the update completes, change the router administrator password to a brand-new strong password.
- If you reuse passwords anywhere else (same password on Wi-Fi, email, or other systems), change those too to reduce reuse risk.
Reduce external reachability (temporary risk reduction if patching is delayed)
- If you have any setting that allows remote administration, WAN-based management, or admin access from the internet, disable it.
- Ensure the router admin page is only accessible from your internal network.
Validate nothing else is affected
- Re-check the firmware versions after upgrading.
- If you see unexpected admin logins or changes to network settings, consider further incident steps (review router logs, review DNS settings, and inspect for unusual network changes).
Monitor
- Watch for repeated login attempts or configuration changes in router logs after the change.

KEV note: this CVE is not listed in CISA KEV based on the provided findings, so urgency is driven by the presence of a public exploit and the password exposure mechanism rather than KEV-listed exploitation.

Technical context

Severity is extremely high in scoring terms (reported as 9.8), but the practical risk for a business depends on reachability. The weakness involves a remotely accessible router web page that does not require authentication; when accessed, it exposes the administrator password in clear text before redirecting.

Attack vector: network-based access to the specific router web page (no authentication required). Mechanism: clear-text password disclosure followed by use of that password to obtain administrator access to the router’s web interface.

Exploitation status: a public exploit is available (2 known), indicating exploitability is not theoretical.

Patch: vendor firmware releases are available to address the issue (DGN2200 1.0.0.52; DGND3700 1.0.0.28). KEV is not listed for this CVE per the findings provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.