CVE-2022-41545
MEDIUM EPSS 20.5%
Published Feb 18, 20251y ago · Modified Jun 17, 20261w ago
6.4 CVSS 3.1
Published Feb 18, 2025 1y ago
Last Modified Jun 17, 2026 1w ago
Description
The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authenticates users via basic authentication, with an HTTP header containing a base64 value of the plaintext username and password. Because the web server also does not utilize transport security by default, this renders the administrative credentials vulnerable to eavesdropping by an adversary during every authenticated request made by a client to the router over a WLAN, or a LAN, should the adversary be able to perform a man-in-the-middle attack.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector Adjacent
Attack Complexity High
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
20.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-319
Affected Products 2
References 4
- seclists.org http://seclists.org/fulldisclosure/2025/Feb/12
- seclists.org https://seclists.org/fulldisclosure/2025/Feb/12
- netgear.com https://www.netgear.com/about/security/
- netgear.com https://www.netgear.com/images/datasheet/networking/cablemodems/C7800.pdf
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.