CVE-2024-6646: Netgear WN604 Information Disclosure Flaw

CVE-2024-6646 Overview

CVE-2024-6646 is an information disclosure vulnerability in the Netgear WN604 wireless access point through firmware version 20240710. The flaw resides in the /downloadFile.php endpoint of the device's web interface. An unauthenticated remote attacker can supply the file parameter with the value config to retrieve sensitive device configuration data. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The exploit has been publicly disclosed, and according to the submitter, the vendor was contacted but did not respond.

Critical Impact
Unauthenticated remote attackers can download the full device configuration file, potentially exposing credentials, network settings, and other secrets stored on the access point.

Affected Products

Netgear WN604 wireless access point
Firmware versions up to and including 20240710
/downloadFile.php component of the Web Interface

Discovery Timeline

2024-07-10 - CVE-2024-6646 published to NVD (VulDB identifier VDB-271052)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6646

Vulnerability Analysis

The vulnerability is an information disclosure issue in the web management interface of the Netgear WN604 access point. The /downloadFile.php script accepts a user-controlled file parameter without enforcing authentication or restricting which files may be returned. When an attacker passes file=config, the script returns the device's stored configuration data. This exposes operational secrets to anyone with network access to the management interface. The attack requires no privileges, no user interaction, and can be performed over the network.

Root Cause

The root cause is missing authentication and inadequate input validation on a sensitive file-download endpoint. The handler trusts the file parameter to identify a resource and returns the matching artifact without verifying that the caller is authorized. Exposing a direct handle to the configuration blob through a predictable keyword violates the principle of least privilege and maps directly to [CWE-200].

Attack Vector

An attacker who can reach the WN604 web interface over HTTP sends a single crafted GET request to /downloadFile.php with file=config as the query argument. The device responds with configuration content, which may include administrative credentials, wireless pre-shared keys, SNMP community strings, and RADIUS settings. Because exploitation is a one-shot HTTP request, it is trivially scriptable and well suited to opportunistic internet scanning. No code examples are included here because no verified proof-of-concept code is referenced in the enriched data; see the GitHub Issue Discussion and VulDB #271052 for public details.

Detection Methods for CVE-2024-6646

Indicators of Compromise

HTTP GET requests to /downloadFile.php containing the query string file=config from external or unexpected internal sources.
Web server access logs on the WN604 showing successful 200 responses to downloadFile.php without a prior authenticated session.
Outbound transfers of configuration-sized responses from the access point management IP to unknown clients.

Detection Strategies

Deploy a network IDS signature that alerts on HTTP requests matching the URI pattern downloadFile.php?file=config directed at WN604 management interfaces.
Correlate web access logs with authentication logs to flag downloadFile.php requests that occur without a corresponding admin login event.
Add WN604 management IPs to a monitored asset group and alert on any inbound HTTP traffic from outside approved administrative subnets.

Monitoring Recommendations

Continuously inventory internet-exposed Netgear WN604 devices using external attack-surface scans.
Enable verbose logging on upstream firewalls or reverse proxies that front the management interface and ship logs to a centralized analytics platform.
Review historical traffic for prior requests to /downloadFile.php to determine whether configuration data may already have been exfiltrated.

How to Mitigate CVE-2024-6646

Immediate Actions Required

Remove the WN604 web management interface from any internet-reachable network segment and restrict it to a dedicated management VLAN.
Rotate all credentials, wireless pre-shared keys, RADIUS secrets, and SNMP community strings that may have been stored in the device configuration.
Place the device behind a firewall rule that only permits HTTP/HTTPS access from a small set of trusted administrator workstations.

Patch Information

At the time of this writing, no vendor patch is referenced in the enriched data. According to the public disclosure, Netgear was contacted but did not respond. Organizations should monitor the Netgear Security Advisories page for firmware updates addressing CVE-2024-6646 and consider planning a device replacement if the WN604 remains unpatched, as this model has reached end-of-life status for many deployments.

Workarounds

Enforce network-level access control lists so that /downloadFile.php cannot be reached from untrusted networks.
Terminate management traffic on a VPN or jump host and block direct HTTP access to the access point.
If the device is no longer required, decommission it and migrate to a supported access point that receives security updates.

bash

# Example iptables rule restricting WN604 management access to a trusted admin subnet
# Replace 10.10.0.0/24 with the trusted management subnet and 192.0.2.10 with the WN604 IP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -j DROP