CVE-2017-5521: NETGEAR router web management password disclosure via recovery token

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw yields unauthenticated admin password disclosure, is listed in CISA KEV, has a very high EPSS score, and public exploit code exists.

What it is

Multiple NETGEAR router models expose the admin password through the web management server. When authentication is canceled and password recovery is disabled, the user is redirected to a page leaking a recovery token; supplying that token to /passwordrecovered.cgi?id=TOKEN returns the admin password. This gives full administrative control of the device.

Impact

An attacker obtains the router's admin password, gaining full control of the device including its configuration and network traffic handling. This can enable further compromise of the connected network.

Attack surface

Reachable over the network against the router's web management server; exploitable remotely if remote management is enabled, and over LAN or WLAN otherwise. No authentication is required, and no user interaction is needed beyond the attacker's own requests.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-09-08, and EPSS shows a 30-day exploitation probability of 0.89353 (99.774th percentile). A public Exploit-DB entry (41205) exists, confirming public exploit code.

What to do

• Apply the vendor firmware update referenced in NETGEAR advisory kb.netgear.com/30632 for all affected models.
• If a device is end-of-life and cannot be patched, disconnect it from the network as CISA directs.
• Disable remote management on the router's web interface unless strictly required.
• Enable the password recovery feature with security questions, which causes the exploit to fail.
• Restrict access to the router web management interface to trusted LAN segments only.

Detection

• Monitor web server logs for requests to /passwordrecovered.cgi, especially with id parameters.
• Alert on repeated or unusual access to the router's password recovery redirect page.
• Watch for unexpected logins or configuration changes on the router following recovery page access.
• Review router management access logs for connections from untrusted or external source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.