CVE-2018-21129

Vulnerability

A sensitive information disclosure vulnerability exists in NETGEAR WAC505 and WAC510 wireless access points running firmware versions prior to 5.0.0.17. The flaw allows an attacker to obtain sensitive data from the device, potentially including configuration details or credentials. The affected models are WAC505 (all versions before 5.0.0.17) and WAC510 (all versions before 5.0.0.17) [1].

Exploitation

The advisory does not provide specific exploitation steps. However, based on the CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), an attacker must be on the same network adjacency as the target, requires no authentication or user interaction, and can exploit the vulnerability with low complexity [1].

Impact

Successful exploitation results in disclosure of sensitive information, which could lead to further compromise. The CVSS score of 8.8 indicates high impact on confidentiality, integrity, and availability, meaning an attacker could potentially gain full control of the device or access critical data [1].

Mitigation

NETGEAR has released firmware version 5.0.0.17 to address this vulnerability. Users should download and install the latest firmware for WAC505 and WAC510 from NETGEAR Support as soon as possible [1].