NETGEAR FM114P ProSafe Router Multiple Vulnerabilities

High Nessus Plugin ID 11514


The remote service is subject to an information disclosure flaw.


The NETGEAR FM114P ProSafe Wireless Router (and possibly other devices) discloses the username and password of the WAN when it receives specially crafted UPnP soap requests.

An attacker may use this flaw to steal a valid username and password.

In addition to this, an attacker may use UPnP to disable the firewall rules of that device, thus bypassing the security policy that has been set.


Reconfigure the device to disable remote management or UPnP.

See Also

Plugin Details

Severity: High

ID: 11514

File Name: netgear_password_disclosure.nasl

Version: $Revision: 1.24 $

Type: remote

Family: Misc.

Published: 2003/04/03

Modified: 2016/11/23

Dependencies: 10107, 17975

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:H/RL:U/RC:ND

Vulnerability Information

Required KB Items: www/upnp

Exploit Available: true

Exploit Ease: Exploits are available

Reference Information

BID: 7267, 7270

OSVDB: 57597, 57598