Vulnerability Spotlight: Denial-of-service vulnerabilities in some NETGEAR routers
Summary: Cisco Talos's Dave McDaniel discovered two denial-of-service vulnerabilities in the NETGEAR N300 (WNR2000v5) wireless router, one in its HTTP server and one in the Host Access Point Daemon (hostapd). An unauthenticated attacker can crash the HTTP service with an HTTP request carrying an empty User-Agent string to a page requiring authentication, and crash hostapd with a SOAP request sent in an invalid sequence to the WFAWLANConfig:1#PutMessage service, both causing null pointer dereferences; Talos worked with NETGEAR on a fix and published a Snort rule (50040).
Why it matters: Both flaws are triggered by unauthenticated requests, so anyone who can reach the router can take it down without credentials - and the fix depends on owners of an affordable small-office router actually applying the NETGEAR update.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-5055
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026