The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to bypass authentication via a direct request to (1) gateway/commands/saveconfig.html and (2) stattbl.htm (3) modemmenu.htm (4) onload.htm (5) form.css (6) utility.js and possibly (7) indextop.htm in html/.