CVE-2020-27866
published 2021-02-12CVE-2020-27866: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2…
PriorityP183high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
8.66%
94.5th percentile
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | ac2100_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | ac2400_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | ac2600_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | r6020_firmware | < 1.0.0.48 | 1.0.0.48 |
| netgear | r6080_firmware | < 1.0.0.48 | 1.0.0.48 |
| netgear | r6120_firmware | < 1.0.0.76 | 1.0.0.76 |
| netgear | r6220_firmware | < 1.1.0.104 | 1.1.0.104 |
| netgear | r6230_firmware | < 1.1.0.104 | 1.1.0.104 |
| netgear | r6260_firmware | < 1.1.0.78 | 1.1.0.78 |
| netgear | r6330_firmware | < 1.1.0.78 | 1.1.0.78 |
| netgear | r6350_firmware | < 1.1.0.78 | 1.1.0.78 |
| netgear | r6700_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | r6800_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | r6850_firmware | < 1.1.0.78 | 1.1.0.78 |
| netgear | r6900_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | r7200_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | r7350_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | r7400_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | r7450_firmware | < 1.2.0.76 | 1.2.0.76 |
| netgear | wac104_firmware | < 1.0.4.15 | 1.0.4.15 |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit request targets /setup.cgi with parameters todo=debug&x=currentsetting.htm; a successful bypass returns HTTP 200 with the string 'Debug Enable!' in the response body. ↗
- →Response body match for exploitation confirmation: look for the literal string 'Debug Enable!' in the HTTP response body with a 200 status code. ↗
- →The vulnerable service is mini_httpd listening on TCP port 80; the flaw is in incorrect string matching logic when accessing protected pages — monitor for unauthenticated GET requests to /setup.cgi on affected NETGEAR devices. ↗
- ·The vulnerability is network-adjacent (AV:A), meaning exploitation requires the attacker to be on the same network segment as the affected NETGEAR router — not directly exploitable from the internet. ↗
- ·No authentication is required to exploit this vulnerability, making any unauthenticated request to the debug endpoint immediately suspicious. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.8HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.3HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8q8f-338r-vxhf: NETGEAR WAC104 devices before 1
ghsa_unreviewed·2022-05-24·CVSS 8.8
CVE-2021-35973 [HIGH] CWE-287 GHSA-8q8f-338r-vxhf: NETGEAR WAC104 devices before 1
NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by adding the ¤tsetting.htm substring to the HTTP query, a related issue to CVE-2020-27866. This directly allows the attacker to change the web UI password, and eventually to enable debug mode (telnetd) and gain a shell on the device as the admin limited-user account (however, escalation to root is simple because of weak permissions on the /etc/ directory).
GHSA
GHSA-mj6p-ghhj-r3q4: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260,
ghsa_unreviewed·2022-05-24
CVE-2020-27866 [HIGH] CWE-287 GHSA-mj6p-ghhj-r3q4: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260,
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 firmware version 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.
VulnCheck
NETGEAR ac2100_firmware Authentication Bypass Using an Alternate Path or Channel
vulncheck·2020·CVSS 8.8
CVE-2020-27866 [HIGH] NETGEAR ac2100_firmware Authentication Bypass Using an Alternate Path or Channel
NETGEAR ac2100_firmware Authentication Bypass Using an Alternate Path or Channel
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.
Affected: NETGEAR ac2100_firmware
Required Action: Apply remediations or mitigations per ve
No detection rules found.
Nuclei
SonarQube - Authentication Bypass
nuclei·CVSS 8.8
CVE-2020-27986 [HIGH] SonarQube - Authentication Bypass
SonarQube - Authentication Bypass
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP,
SVN, and GitLab credentials via the api/settings/values URI.
Template:
id: CVE-2020-27986
info:
name: SonarQube - Authentication Bypass
author: pikpikcu
severity: high
description: |
SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP,
SVN, and GitLab credentials via the api/settings/values URI.
impact: |
Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to sensitive information.
remediation: Reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it."
reference:
- https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/
- https://n
Nuclei
NETGEAR - Authentication Bypass
nuclei·CVSS 8.8
CVE-2020-27866 [HIGH] NETGEAR - Authentication Bypass
NETGEAR - Authentication Bypass
NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations.
Template:
id: CVE-2020-27866
info:
name: NETGEAR - Authentication Bypass
author: gy741
severity: high
description: NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations.
impact: |
Successful exploitation of this vulnerability can lea
https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routershttps://www.zerodayinitiative.com/advisories/ZDI-20-1451/https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routershttps://www.zerodayinitiative.com/advisories/ZDI-20-1451/
2021-02-12
Published
Exploited in the wild