id: netgear-router-exposure
info:
name: NETGEAR Router S/N Disclosure
author: geeknik
severity: critical
description: Multiple NETGEAR router models disclose their serial number which can be used to obtain the admin password if password recovery is enabled.
reference:
- https://www.exploit-db.com/exploits/47117
- https://www.exploit-db.com/exploits/45741
tags: netgear,exposure,iot,router
requests:
- method: GET
path:
- "{{BaseURL}}/rootDesc.xml"
matchers-condition: and
matchers:
- type: status
status:
- 200
- 501
condition: or
- type: word
words:
- "<serialNumber>"
- "<deviceType>"
- "<modelNumber>"
condition: and
part: header
- text/xml
extractors:
- type: regex
group: 1
regex:
- "<serialNumber>([A-Z0-9]+)<\\/serialNumber>"
