CVE-2019-20676

CWE-862 — Missing Authorization3 documents3 sources

Severity

6.0MEDIUM

EPSS

0.1%

top 71.91%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Netgear Fs728tlp Firmware Netgear Gs105e Firmware Netgear Gs105pe Firmware +19 more

Timeline

PublishedApr 15

Latest updateMay 24

Description

Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS724TPv2 before 1.1.1.29, GS808E before 1.7.0.7, GS810EMX before 1.7.1.1, GS908E before 1.7.0.3, GSS108E before 1.6.0.4, GSS108EPP before 1.0.0.15, GSS116E before 1.6.0.9, JGS516PE before 2.6.0.35,…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 0.8 | Impact: 5.2

Affected Packages22 packages

▶NVDnetgear/gss108epp_firmware< 1.0.0.15

▶NVDnetgear/gs808e_firmware< 1.7.0.7

▶NVDnetgear/gs908e_firmware< 1.7.0.3

▶NVDnetgear/xs716e_firmware< 1.6.0.23

▶NVDnetgear/gs105pe_firmware< 1.6.0.4

🔴Vulnerability Details

GHSA

GHSA-g7qr-7xf7-f4ph: Certain NETGEAR devices are affected by lack of access control at the function level↗2022-05-24

▶

CVEList

CVE-2019-20676: Certain NETGEAR devices are affected by lack of access control at the function level↗2020-04-15

▶