CVE-2020-26919
published 2020-10-09CVE-2020-26919: NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
57.54%
99.0th percentile
NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | jgs516pe_firmware | < 2.6.0.43 | 2.6.0.43 |
Detection & IOCsextracted from sources · hover to see the quote
url/login.htm
commandsubmitId=debug&debugCmd=
snort
alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Netgear ProSAFE Plus Unauthenticated RCE Inbound (CVE-2020-26919)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/login.htm"; http.request_body; content:"submitId=debug&debugCmd="; startswith; fast_pattern; reference:url,research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/; reference:cve,2020-26919; classtype:attempted-admin; sid:2031936; rev:2; metadata:attack_target Networking_Equipment, created_at 2021_03_11, cve CVE_2020_26919, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_03_11;)
- →Exploit traffic is an HTTP POST to /login.htm with a body beginning with 'submitId=debug&debugCmd='. The login.htm endpoint is publicly exposed and does not restrict debug actions, making it the canonical attack surface.
- →Any HTML page on the device can be used as a POST endpoint for debug commands — not just /login.htm. Defenders should alert on POST requests to any .htm path on the device containing 'submitId=debug&debugCmd=' in the body.
- →The Snort/ET rule (sid:2031936) keys on: HTTP POST method, URI containing '/login.htm', and request body starting with 'submitId=debug&debugCmd=' (fast_pattern, startswith). Deploy at both Perimeter and Internal chokepoints.
- →Observed exploit payload uses 'wget' to beacon out to an attacker-controlled URL, indicating OOB (out-of-band) callback as a common exploitation technique. Monitor for unexpected outbound HTTP from network switch management IPs.
- ·The vulnerability is unauthenticated — no session token or credential is required to trigger RCE. Any network-reachable device running firmware before 2.6.0.43 is exploitable without prior access. ↗
- ·This is a CISA KEV (Known Exploited Vulnerability) with an EPSS score of 0.939 (99.877th percentile), indicating active in-the-wild exploitation. Prioritize detection and patching accordingly.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cwxx-ph2v-87p8: NETGEAR JGS516PE devices before 2
ghsa_unreviewed·2022-05-24
CVE-2020-26919 [CRITICAL] GHSA-cwxx-ph2v-87p8: NETGEAR JGS516PE devices before 2
NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
VulnCheck
Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
vulncheck·2020·CVSS 9.8
CVE-2020-26919 [CRITICAL] Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
Netgear JGS516PE devices contain a missing function level access control vulnerability.
Affected: NETGEAR JGS516PE Devices
Required Action: Apply updates per vendor instructions.
Exploitation References: https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/; https://unit42.paloaltonetworks.com/network-attack-trends-february-april-2021/; https://www.radware.com/getmedia/18d24c2d-c092-4a61-9ad6-ebb92b7a49b8/Alert_Realtek_SDK.aspx; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://eclypsium.com/blog/vulnerabilities-in-netgear-firmware-based-iot-devices-in-the-enterprise/
Remediation Due: 2022-05-03
CISA
Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2020-26919 [CRITICAL] Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
Vulnerability: Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
Affected: NETGEAR JGS516PE Devices
Netgear JGS516PE devices contain a missing function level access control vulnerability.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-26919
Remediation Due Date: 2022-05-03
Suricata
ET EXPLOIT Netgear ProSAFE Plus Unauthenticated RCE Inbound (CVE-2020-26919)
suricata·2021-03-11·CVSS 9.8
CVE-2020-26919 [CRITICAL] ET EXPLOIT Netgear ProSAFE Plus Unauthenticated RCE Inbound (CVE-2020-26919)
ET EXPLOIT Netgear ProSAFE Plus Unauthenticated RCE Inbound (CVE-2020-26919)
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Netgear ProSAFE Plus Unauthenticated RCE Inbound (CVE-2020-26919)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/login.htm"; http.request_body; content:"submitId=debug&debugCmd="; startswith; fast_pattern; reference:url,research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/; reference:cve,2020-26919; classtype:attempted-admin; sid:2031936; rev:2; metadata:attack_target Networking_Equipment, created_at 2021_03_11, cve CVE_2020_26919, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Gene
Nuclei
NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
nuclei·CVSS 9.8
CVE-2020-26919 [CRITICAL] NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.
Template:
id: CVE-2020-26919
info:
name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
author: gy741
severity: critical
description: NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowe
Unit42
Network Attack Trends: February-April 2021
blogs_unit42·2021-07-01
Network Attack Trends: February-April 2021
## Executive Summary
Unit 42 researchers observed network attack trends, February-April 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity and category. Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. We then draw conclusions about the most commonly exploited vulnerabilities the attackers are using, as well as the severity, category and origin of each attack.
## Network Attack Trends February-April 2021: Analysis of the Latest Published Vulnerabilities
From February-April 2021, a total of 4,969 new Common Vulnerabilities and Exposures (CVE) numbers were registered. To better und
Unit42
Network Attack Trends: February-April 2021
blogs_unit42·2021-07-01
Network Attack Trends: February-April 2021
Threat Research Center
Trend Reports
Vulnerabilities
## Network Attack Trends: February-April 2021
Yue Guan
Lei Xu
Vaibhav Singhal
Brock Mammen
Published: July 1, 2021
Trend Reports
Vulnerabilities
Network security trends
## Executive Summary
Unit 42 researchers observed network attack trends, February-April 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity and category. Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls . We then draw conclusions about the most commonly exploited vulnerabilities the attackers are using, as well as the severity, category and origin of
Unit42
New Mirai Variant Targeting Network Security Devices
blogs_unit42·2021-03-16·CVSS 7.5
CVE-2019-19356 [HIGH] New Mirai Variant Targeting Network Security Devices
Threat Research Center
Threat Research
Vulnerabilities
## New Mirai Variant Targeting Network Security Devices
Vaibhav Singhal
Ruchna Nigam
Zhibin Zhang
Asher Davila
Published: March 15, 2021
Threat Research
Vulnerabilities
CVE-2019-19356
CVE-2020-25506
CVE-2020-26919
CVE-2021-22502
CVE-2021-27561
CVE-2021-27562
IoT
Mirai
VisualDoor
## Executive Summary
On Feb. 16, 2021, Unit 42 researchers discovered attacks leveraging a number of vulnerabilities, including:
VisualDoor (a SonicWall SSL-VPN exploit).
CVE-2020-25506 (a D-Link DNS-320 firewall exploit).
CVE-2020-26919 (a Netgear ProSAFE Plus exploit).
Possibly CVE-2019-19356 (a Netis WF2419 wireless router exploit).
Three other IoT vulnerabilities yet to be identified.
On Feb. 23, 2021, one of the IPs involved
Unit42
New Mirai Variant Targeting Network Security Devices
blogs_unit42·2021-03-16·CVSS 7.5
CVE-2020-25506 [HIGH] New Mirai Variant Targeting Network Security Devices
## Executive Summary
On Feb. 16, 2021, Unit 42 researchers discovered attacks leveraging a number of vulnerabilities, including:
- VisualDoor (a SonicWall SSL-VPN exploit).
- CVE-2020-25506 (a D-Link DNS-320 firewall exploit).
- CVE-2020-26919 (a Netgear ProSAFE Plus exploit).
- Possibly CVE-2019-19356 (a Netis WF2419 wireless router exploit).
- Three other IoT vulnerabilities yet to be identified.
On Feb. 23, 2021, one of the IPs involved in the attack was updated to serve a Mirai variant leveraging CVE-2021-27561 and CVE-2021-27562, mere hours after vulnerability details were published. On March 3, 2021, the same samples were served from a third IP address, with the addition of an exploit leveraging CVE-2021-22502. Furthermore, on March 13, an exploit targeting CVE-2020-26919 was also
https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-26919
2020-10-09
Published
2021-11-03
Added to CISA KEV
Exploited in the wild