CVE-2020-17409

CWE-2883 documents3 sources

Severity

6.5MEDIUM

EPSS

0.3%

top 46.77%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Netgear R6020 Firmware Netgear R6080 Firmware Netgear R6120 Firmware +7 more

Timeline

PublishedOct 13

Latest updateMay 24

Description

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020, JNR3210, and WNR2020 routers with firmware 1.0.66. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability …

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages10 packages

▶NVDnetgear/r6020_firmware< 1.0.0.44

▶NVDnetgear/r6080_firmware< 1.0.0.44

▶NVDnetgear/r6120_firmware< 1.0.0.70

▶NVDnetgear/r6220_firmware< 1.1.0.100

▶NVDnetgear/r6260_firmware< 1.1.0.76

Patches

Patch: kb.netgear.com ↗Patch: kb.netgear.com ↗

🔴Vulnerability Details

GHSA

GHSA-x2v7-676c-4x7c: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220↗2022-05-24

▶

CVEList

CVE-2020-17409: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220↗2020-10-13

▶