CVE-2016-11058

Vulnerability

The NETGEAR genie app for Android versions 2.4.28 and earlier mishandles hard-coded API keys and session IDs [1]. This vulnerability allows an attacker to interact with OpenDNS servers on behalf of the app without proper authentication.

Exploitation

An attacker with network access or the ability to intercept app traffic can extract the hard-coded API keys and session IDs. No user interaction beyond normal app use is required; the attacker can then use these credentials to add or delete devices via OpenDNS servers [1].

Impact

Successful exploitation allows an attacker to add or remove devices associated with the victim's OpenDNS account, potentially disrupting network management or enabling further malicious actions. The confidentiality of API keys and session IDs is compromised, leading to unauthorized device control [1].

Mitigation

NETGEAR released version 2.4.34 of the genie app for Android to fix this issue [1]. The update removes exposure of API keys and session IDs. Users should download the update from the Google Play Store [1]. No workaround is available for earlier versions.