Netgear DGN2200 and DGND3700 disclose the administrator password
Priority MEDIUM 63CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-319.
Summary
A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.
Why it matters now
EPSS 0.23582 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NETGEAR | DGN2200 | DGN2200-V1.0.0.50_7.0.50 | — | No fix listed | CNA |
| NETGEAR | DGND3700 | DGND3700-V1.0.0.17_1.0.17 | — | No fix listed | CNA |
- DGN2200 VendorNETGEAR Affected DGN2200-V1.0.0.50_7.0.50 Fixed in — No fix listed CNA
- DGND3700 VendorNETGEAR Affected DGND3700-V1.0.0.17_1.0.17 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netgear:dgn2200_firmware:1.0.0.50_7.0.50:*:*:*:*:*:*:* | 1.0.0.50_7.0.50 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:dgn2200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
| cpe:2.3:o:netgear:dgnd3700_firmware:1.0.0.17_1.0.17:*:*:*:*:*:*:* | 1.0.0.17_1.0.17 | Vulnerable | NETGEAR |
| cpe:2.3:h:netgear:dgnd3700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NETGEAR |
- cpe:2.3:o:netgear:dgn2200_firmware:1.0.0.50_7.0.50:*:*:*:*:*:*:* Versions 1.0.0.50_7.0.50 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:dgn2200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
- cpe:2.3:o:netgear:dgnd3700_firmware:1.0.0.17_1.0.17:*:*:*:*:*:*:* Versions 1.0.0.17_1.0.17 Vulnerable ·NETGEAR
- cpe:2.3:h:netgear:dgnd3700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-5649
- 2026-10-03 Alias added: GHSA-xgqp-24fp-7v85
References
More NETGEAR Dgn2200 Firmware vulnerabilities
- TI-2017-03982 ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-16116 Certain NETGEAR devices are affected by lack of access control at the function level. CVSS 3.1CRITICAL 10.0
- TI-2019-12970 Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via… CVSS 3.1CRITICAL 9.8
- TI-2024-37767 A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier… CVSS 3.1HIGH 8.8
- TI-2017-04186 Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware… CVSS 3.0HIGH 8.8
- TI-2020-18229 NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka… CVSS 3.1HIGH 8.8
Sources
- CVE-2016-5649 · CVE Program
- CVE-2016-5649 · NVD
- FIRST EPSS
- GHSA-xgqp-24fp-7v85 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences