CVE-2024-30569

The Netgear R6850 leaks device information through currentsetting.htm to anyone who asks, no authentication required. It's a consumer-grade router handing out details about itself, and while that's only a disclosure, on home and small-office gear those details often include firmware and configuration hints that make the box easy to fingerprint and target.

Consumer routers are a perennial botnet target precisely because they're internet-facing by nature, rarely patched, and numerous. A no-auth information endpoint like this is bulk reconnaissance material: scanners sweep for it to enumerate vulnerable models at scale, then match them to the exploit that actually grants control. The leak itself doesn't take the router, but it's the sorting step before something that does.

For us this is about knowing where these devices sit and whether they should be talking to the internet at all. Where an R6850 is doing edge duty, we want its management surface off the public side and its firmware current. The information leak ranks as moderate on its own, but on an exposed consumer router it's a reliable early indicator that the device is both findable and probably behind on updates.