CVE-2019-17137
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings. By inserting a null byte into the path, the user can skip most authentication checks. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-8616.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.4
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
- EPSS probability
- 0.43%
- CWE
- CWE-626
- Published
- 2020-02-10
- Last modified
- 2026-03-14
Affected products
- NETGEAR AC1200
Weakness type
Related vulnerabilities
- CVE-2026-76816 — Netty: MQTT Topic Name and Client ID Validation Bypass
- CVE-2026-62380 — Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection
- CVE-2026-42579 — Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
- CVE-2026-42040 — Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
- CVE-2020-10773 — A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager...
- CVE-2019-11936 — Various APC functions accept keys containing null bytes as input, leading to premature truncation...