Netgear DGND3700 1.1.00.15_1.00.15NA Basic Authentication /BRS_top.html improper authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in Netgear DGND3700 1.1.00.15_1.00.15NA. Affected by this vulnerability is an unknown functionality of the file /BRS_top.html of the component Basic Authentication. Performing a manipulation results in improper authentication. This vulnerability is cataloged as CVE-2025-4978. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to use restrictive firewalling. Other products might be affected as well. The vendor was contacted early about this disclosure.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Netgear DGND3700 1.1.00.15_1.00.15NA. This affects an unknown functionality of the file /BRS_top.html of the component Basic Authentication. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-4978. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/20/2025).

The exploit is shared for download at github.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure. Other products might be affected as well. By approaching the search of inurl:BRS_top.html it is possible to find vulnerable targets with Google Hacking.

It is possible to mitigate the weakness by firewalling .

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• DGND3700

Version

• 1.1.00.15_1.00.15NA

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #564712: Netgear DGND3700v2 V1.1.00.15_1.00.15NA Backdoor (by 153528990)

Be aware that VulDB is the high quality source for vulnerability data.

Discussion