CASCACascade Atlas

Evidence dossier

CVE-2017-5521

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices.

Exploited in the wild (CISA KEV since Sep 8, 2022). NVD reports CVSS 3.1 8.1. EPSS estimates 89.4% exploit likelihood as of Aug 26, 2026.

86.0–86.8Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.

State
PUBLISHED
Published
Jan 17, 2017
Updated
Oct 21, 2025
Evidence coverage
98%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    mitre

    Record text: An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.

    Inspect raw assertion
    Field
    container
    Value
    An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 89.35% probability · 99.77th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.893530000000; percentile 0.997700000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Sep 8, 2022 · first observed Jul 19, 2026

Exploit likelihood89.35%

FIRST EPSS · score date Aug 26, 2026 · 99.8th percentile · first observed Aug 26, 2026

SeverityCVSS 8.1

NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Aug 27, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Aug 27, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
mitreOriginal assertion
Record text

An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.

Inspect raw assertion
Field
container
Value
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

89.35% probability · 99.77th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.893530000000; percentile 0.997700000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
26Underlying assertions
26Canonical products
13Target assertions
13Constraint assertions

Grouped from 26 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

27 scope groups

mitre · source assertedn/an/aDirect source scope
Affected: n/a
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "n/a"}]
NVD CPE · HARDWAREnetgearac1450Environmental constraint · 1 assertions
Version not applicableCanonical identity product-78901a1fa644d1f55d4e7bd7e29d16ffc83a028bb27195c267240492bf756167Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:ac1450:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    3 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e4ba18b2-8234-4c26-b865-741d467c5ebe
NVD CPE · OPERATING SYSTEMnetgearac1450_firmwareVulnerable target · 1 assertions
Version 1.0.0.34_10.0.16Canonical identity product-1ca8b0b49a478839193601444ce0655b7136f598911b9456125dcfe3e132b0faLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:ac1450_firmware:1.0.0.34_10.0.16:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    3 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    91292776-92f7-4089-86fc-7569c8f940de
NVD CPE · HARDWAREnetgeard6220Environmental constraint · 1 assertions
Version not applicableCanonical identity product-2ce426e4e29980570f61de190ed6d0f8cc70f523c8ca196625365847a61a711dLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:d6220:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    9 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f3eea190-2e9c-4586-bf81-b115532fba23
NVD CPE · OPERATING SYSTEMnetgeard6220_firmwareVulnerable target · 1 assertions
Version 1.0.0.12Canonical identity product-a2805d48a177b2fa8b8d93223a2304e6a40162df203081f63d4e591c998933c4Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:d6220_firmware:1.0.0.12:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    9 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ecd46588-5866-4159-85e1-58b0d1f98406
NVD CPE · HARDWAREnetgeard6300Environmental constraint · 1 assertions
Version not applicableCanonical identity product-5c56fb2ce739eebb022fb980e3b879de4846746b8ede066b2b7d061eddd171c0Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:d6300:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    10 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    78542c95-85cc-43e5-9f0e-b12ddd5b79c4
NVD CPE · HARDWAREnetgeard6300bEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-5de770fa4f58cbf5da1dca0b41934cf13caec53be143dcbd554d621f98dd8feeLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:d6300b:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    11 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    37b89703-cafb-43f6-8880-90349f8ed856
NVD CPE · OPERATING SYSTEMnetgeard6300b_firmwareVulnerable target · 1 assertions
Version 1.0.0.40Canonical identity product-e9b7fb8e1a34ca7d82fb9704d2cd186d2f9956be321a967716a52757a28fdfe9Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:d6300b_firmware:1.0.0.40:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    11 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d0ce8a8f-7894-4140-8e4b-84153c5a6b13
NVD CPE · OPERATING SYSTEMnetgeard6300_firmwareVulnerable target · 1 assertions
Version 1.0.0.96Canonical identity product-699c06a091ae0de1269edc62e261faf97b238a565e4913ae0d02b92c2c5974caLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:d6300_firmware:1.0.0.96:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    10 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7b15b85c-f099-4584-9f59-1cfc3275d625
NVD CPE · HARDWAREnetgeard6400Environmental constraint · 1 assertions
Version not applicableCanonical identity product-f258e235517da9ee8c9eaf46fb51e0c52b2cd74c0d0d1f9094d0535b4034aa75Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:d6400:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    8 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7d30939b-86e3-4c78-9b05-686b4994c8b9
NVD CPE · OPERATING SYSTEMnetgeard6400_firmwareVulnerable target · 1 assertions
Version 1.0.0.44Canonical identity product-1d83b3f8daf96b3d94c026537b71ed67caf02a1c594727eb610b0a62559fb9f4Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:d6400_firmware:1.0.0.44:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    8 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d3eb5f49-3628-4418-af36-af8fd6f5ba25
NVD CPE · HARDWAREnetgeardgn2200bv4Environmental constraint · 1 assertions
Version not applicableCanonical identity product-0bfaa204dd82d5a087919f7ae784e7d0f5554c59f1961d7cafa16508318537b0Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:dgn2200bv4:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    12 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9c78a475-9ddf-432b-a94a-01efac7dc70d
NVD CPE · OPERATING SYSTEMnetgeardgn2200bv4_firmwareVulnerable target · 1 assertions
Version 1.0.0.68Canonical identity product-b174afcf0a4762b78ca8590e356c228306cb27838aa389dbbee1943e0ff880deLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:dgn2200bv4_firmware:1.0.0.68:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    12 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    e1cdfe4f-6c5c-4b10-926e-92c7759d60ef
NVD CPE · HARDWAREnetgearr6200Environmental constraint · 1 assertions
Version not applicableCanonical identity product-6f1a2950ffe33a1fbc7fa275ffdae3e9da9159ff39988a8fde0f1a4f4054debdLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:r6200:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8a466b29-3ada-46d9-824c-8df9160b7dd7
NVD CPE · OPERATING SYSTEMnetgearr6200_firmwareVulnerable target · 1 assertions
Version 1.0.1.56_1.0.43Canonical identity product-291e9d215379428e1a6804ed100425573a87ddc960af76b1f231acf22d51dd10Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:r6200_firmware:1.0.1.56_1.0.43:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1c1769f8-b2cb-465b-85b8-9d7ac25c63cb
NVD CPE · HARDWAREnetgearr6300Environmental constraint · 1 assertions
Version not applicableCanonical identity product-7d7b5a7481dff77f49bf4d75d1f04adff1230e31dd2e6779ec489b0c462cf30aLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:r6300:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    9597966a-b13c-4098-838b-ec9aa8de443d
NVD CPE · OPERATING SYSTEMnetgearr6300_firmwareVulnerable target · 1 assertions
Version 1.0.2.78_1.0.58Canonical identity product-6bd57eb5599d94701e5301c46a948515d14675b06dc252b5f955137b758c2c6cLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:r6300_firmware:1.0.2.78_1.0.58:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    89a99d1c-cabe-4526-b3b7-3708c0e18ac4
NVD CPE · HARDWAREnetgearvegn2610Environmental constraint · 1 assertions
Version not applicableCanonical identity product-dcb22b0bf75e877a3285be1374276073dcd6dcf349108a2870e5f9be6d2769b7Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:vegn2610:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    2 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    0967fc76-f977-4d18-b570-9444459a19fe
NVD CPE · OPERATING SYSTEMnetgearvegn2610_firmwareVulnerable target · 1 assertions
Version 1.0.0.36Canonical identity product-53840050ddf32612953bab21c9b0a4d421d84004ce07d849918fe3a343be01e8Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:vegn2610_firmware:1.0.0.36:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    6d329d85-c180-426e-b430-9fede5c77f25
NVD CPE · HARDWAREnetgearwndr3700v3Environmental constraint · 1 assertions
Version not applicableCanonical identity product-a49757156f04ebe23827dc4723d62c1ff002f860780ffdd8b05da7a02c375d9bLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wndr3700v3:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    5 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    603836e6-e7ff-43c7-a410-8bd9d0950f7c
NVD CPE · OPERATING SYSTEMnetgearwndr3700v3_firmwareVulnerable target · 1 assertions
Version 1.0.0.40_1.0.32Canonical identity product-fcb7ddf753fbc22ed4cb0d9ddf1208d0acf3d4361d4df8b2a26eea3bbd10d9ffLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wndr3700v3_firmware:1.0.0.40_1.0.32:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    5 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1d59a6f9-0359-4ab4-ad0f-1d6044d59409
NVD CPE · HARDWAREnetgearwndr4000Environmental constraint · 1 assertions
Version not applicableCanonical identity product-af6c96b263779fd95b50ae77130b4f04d744257b331b202c2a4f62aedcc60a49Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wndr4000:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1c34ec74-d6f1-46f1-b47e-e62793171427
NVD CPE · OPERATING SYSTEMnetgearwndr4000_firmwareVulnerable target · 1 assertions
Version 1.0.2.4_9.1.86Canonical identity product-3d4faee8f347c27d212a3fa37b148242222ae064841786d27c25b1eb31c5c058Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wndr4000_firmware:1.0.2.4_9.1.86:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    91561a20-30f5-4163-9178-5fc32897f827
NVD CPE · HARDWAREnetgearwndr4500Environmental constraint · 1 assertions
Version not applicableCanonical identity product-2f3e7ae83c623dd050ba2970a0a2095c8f55dc9aab4036bf2d0a1d3e95888190Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netgear:wndr4500:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    7 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7e9f459c-b628-402a-af4a-72e08fe41837
NVD CPE · OPERATING SYSTEMnetgearwndr4500_firmwareVulnerable target · 1 assertions
Version 1.0.1.44_1.0.73Canonical identity product-7deabcdaa52d4be83fc5b2c170bbc2145b9bb6e3e4d8e89223eafa88c133aa59Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netgear:wndr4500_firmware:1.0.1.44_1.0.73:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    7 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b9874914-4d90-493f-bd2b-40fff1737f58

Affected-product evidence

Accepted scope and product mapping

13 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-1ca8b0b49a478839193601444ce0655b7136f598911b9456125dcfe3e132b0fa

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
6b60cb9d-1ab3-478a-858e-2b687cb76559
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-1d83b3f8daf96b3d94c026537b71ed67caf02a1c594727eb610b0a62559fb9f4

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
958f37c8-07c6-4b89-9e45-bd787ea37959
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-291e9d215379428e1a6804ed100425573a87ddc960af76b1f231acf22d51dd10

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
76b84bd0-bcae-4a0a-83d1-18a660dc8eb7
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-3d4faee8f347c27d212a3fa37b148242222ae064841786d27c25b1eb31c5c058

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
f1ace344-1863-438c-881e-6593c43314ce
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-53840050ddf32612953bab21c9b0a4d421d84004ce07d849918fe3a343be01e8

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
fa2efeb0-e380-4cf4-9bf3-6f430136c57c
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-699c06a091ae0de1269edc62e261faf97b238a565e4913ae0d02b92c2c5974ca

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
914f2b8b-d5e5-48ed-a838-36aa76668893
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-6bd57eb5599d94701e5301c46a948515d14675b06dc252b5f955137b758c2c6c

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
26340bdb-4354-4e05-9c4d-8532eb3fce94
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-7deabcdaa52d4be83fc5b2c170bbc2145b9bb6e3e4d8e89223eafa88c133aa59

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
4e887299-e7ba-4d57-9b19-625c29bfd996
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-a2805d48a177b2fa8b8d93223a2304e6a40162df203081f63d4e591c998933c4

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
1d889e0f-9298-42dd-ab97-0cad56a1a3d0
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-b019e38ce2671e1feb8319d39773648ff97b29771198432995c66652bfc16b13

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
d2a5eb6a-292d-4bbd-b459-b7aba3c0bec7
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-b174afcf0a4762b78ca8590e356c228306cb27838aa389dbbee1943e0ff880de

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
0a8cb3f4-466f-4e80-bd58-25e9db570769
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-e9b7fb8e1a34ca7d82fb9704d2cd186d2f9956be321a967716a52757a28fdfe9

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
bb98f2f0-c73f-4286-a433-236218b59134
Mapping establishedEvidence supported

vendor-e6bb97853bfb2ac91ae14d10c2c66badc0ed5b9045d86cd4261f6013a132d9c2 · product-fcb7ddf753fbc22ed4cb0d9ddf1208d0acf3d4361d4df8b2a26eea3bbd10d9ff

Source class
Nvd cpe vulnerable target
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
776d2732-0213-4080-af28-b9b11ba6c450
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
1
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
778abc5a-f529-4c14-bdd7-dd7110f17f9a

Assessments

CVSS by origin

8.1
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.3
NVDCVSS 2.0 · role Primary · priority eligiblevalid_matchAV:N/AC:M/Au:N/C:P/I:N/A:N
8.1
CVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1
CISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Direct CVE/CNA normalized decisions

8.1Priority eligible

CISA-ADP

CVSS 3.1 · Secondary · Independent enrichment · rank 2

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Validation
Valid match
Recomputed
8.1
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.