NETGEAR CG3700B Firmware vulnerabilities

3 CVEs affecting NETGEAR CG3700B Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-13395, published 2020-03-13.

More from NETGEAR.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-13393, published 2020-03-13. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared key. Either an attack against HTTP Basic…
• CVE-2019-13394, published 2020-03-13. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP.
• CVE-2019-13395, published 2020-03-13. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys, restore the router to factory…