Security Advisory
CVE-2019-12510
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the devices "NETGEAR Genie" SOAP API ("/soap/server_sa") by supplying a malicious X-Forwarded-For header of the devices LAN IP address (192.168.1.1) in every request. As a result, an attacker may modify almost all of the devices settings and view various configuration settings.