CVE-2025-4978

The vulnerability is due to improper authentication implementation (CWE-287) in the component handling the /BRS_top.html file. This resource is accessible without required authentication, allowing an attacker to bypass the Basic Authentication mechanism. The attack can be conducted remotely over the network, without user interaction and without any prior privileges. The exploit has been made public and may be actively exploited.

An attacker can gain unauthorized access to protected device resources, threatening the confidentiality, integrity, and availability of the system. This could lead to takeover of the router and modification of its configuration.

Patches available from the manufacturer should be applied according to the references. It is recommended to monitor official Netgear security communications at https://www.netgear.com/. Until a patch is released, it is recommended to restrict access to the device management interface through a firewall or network segmentation.

Netgear DGND3700 with firmware version 1.1.00.15_1.00.15NA. According to manufacturer information, other Netgear products may also be affected.