Vulnerabilities > CVE-2019-5054 - NULL Pointer Dereference vulnerability in Netgear Wnr2000 Firmware 1.0.0.70
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) HTTP server. An HTTP request with an empty User-Agent string sent to a page requiring authentication can cause a null pointer dereference, resulting in the HTTP service crashing. An unauthenticated attacker can send a specially crafted HTTP request to trigger this vulnerability.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 1 | |
| Hardware | 1 |
Common Weakness Enumeration (CWE)
Talos
| id | TALOS-2019-0831 |
| last seen | 2019-09-14 |
| published | 2019-09-09 |
| reporter | Talos Intelligence |
| source | http://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0831 |
| title | NETGEAR N300 WNR2000v5 unauthenticated HTTP denial-of-service vulnerability |