CVE-2020-27867
Severity
6.8MEDIUM
EPSS
0.2%
top 62.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedFeb 12
Latest updateMay 24
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. When parsing the funjsq_access_t…
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9
Affected Packages20 packages
🔴Vulnerability Details
3GHSA▶
GHSA-9xcx-66r3-hp2h: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260,↗2022-05-24
CVEList▶
CVE-2020-27867: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260,↗2021-02-11
VulnCheck▶
NETGEAR ac2100_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')↗2020