NetGear WNDR Authentication Bypass Vulnerability

[Xircal]

A vulnerability exists in a number of Netgear routers whereby a remote user can bypass authentication.

Known and suspect models can be found on the following site together with details of the vulnerability. http://www.securitytracker.com/id/1031762

See this Wikipedia article for an explanation of SOAP: http://en.wikipedia.org/wiki/SOAP

No fix was available at the time of writing.

Workaround: disable remote / WAN management.

[RichCor]

Sound like Netgear needs to hire 5-year-old Kristoffer to do product vulnerability testing.

"At first glance, this service [sOAP / NetGear Genie application ] appears to be filtered and authenticated;

HTTP requests with a `SOAPAction` header set but without a session identifier will yield a HTTP 401 error. However, a HTTP request with a

blank form and a `SOAPAction` header is sufficient to execute certain requests and query information from the device."

Yep, Kristoffer would have found this vulnerability with his 'blank' and 'multiple spaces as a valid entry' routine.