CVE-2019-5055 - An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) wireless router

Back Back to CVE browser

HIGH

An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) wireless router

Published Sep 11, 2019

7.5

HIGH

CVSS 3.1

EPSS 2.01%

Description

An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) wireless router. A SOAP request sent in an invalid sequence to the <WFAWLANConfig:1#PutMessage> service can cause a null pointer dereference, resulting in the hostapd service crashing. An unauthenticated attacker can send a specially-crafted SOAP request to trigger this vulnerability.

Affected products

Vendor NETGEAR Product n/a Default
n/a
- Version
  Firmware Version V1.0.0.70
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NETGEAR

n/a

Version	Status	Constraints
Firmware Version V1.0.0.70	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-14662
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0832
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-14662		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0832		x_refsource_MISCExploitThird Party Advisory