Netgear Jgs516Pe Firmware vulnerabilities

CVE-2020-35229 [HIGH] CWE-384 CVE-2020-35229: The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0 The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated and can be reused until a new token is generated, which allows attackers (with access to network traffic) to effectively gain administrative privileges.

CVE-2020-35221 [HIGH] CWE-326 CVE-2020-35221: The hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2 v2.6 The hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was found to be insecure, allowing attackers (with access to a network capture) to quickly generate multiple collisions to generate valid passwords, or infer some parts of the original.

CVE-2020-35231 [HIGH] CWE-287 CVE-2020-35231: The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an a The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of the device.

CVE-2020-35226 [HIGH] CWE-306 CVE-2020-35226: NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP co NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP configuration by sending the corresponding write request command.

CVE-2020-35223 [HIGH] CWE-352 CVE-2020-35223: The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116E The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed by omitting the CSRF token parameter in HTTP requests.

CVE-2020-35227 [HIGH] CWE-120 CVE-2020-35227: A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices (in the administration web panel) allows an attacker to inject IP addresses into the whitelist via the checkedList parameter to the delete command.

CVE-2020-35233 [MEDIUM] CWE-400 CVE-2020-35233: The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, and allows external attackers to force device reboots by sending concurrent connections, aka a denial of service attack.

CVE-2020-35225 [MEDIUM] CWE-120 CVE-2020-35225: The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was not properly val The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was not properly validating the length of string parameters sent in write requests, potentially allowing denial of service attacks.

CVE-2020-35228 [MEDIUM] CWE-79 CVE-2020-35228: A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116 A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter.

CVE-2020-35224 [MEDIUM] CWE-120 CVE-2020-35224: A buffer overflow vulnerability in the NSDP protocol authentication method on NETGEAR JGS516PE/GS116 A buffer overflow vulnerability in the NSDP protocol authentication method on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote unauthenticated attackers to force a device reboot.

CVE-2020-35230 [MEDIUM] CWE-190 CVE-2020-35230: Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/ Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices. Most of the integer parameters sent through the web server can be abused to cause a denial of service attack.

CVE-2020-35784 [MEDIUM] CVE-2020-35784: Certain NETGEAR devices are affected by lack of access control at the function level. This affects J Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and GS116Ev2 before 2.6.0.48.

CVE-2020-35801 [HIGH] CVE-2020-35801: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects J Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. A TFTP server was found to be active by default. It allows remote authenticated users to update the switch firmware.

CVE-2020-35782 [HIGH] CVE-2020-35782: Certain NETGEAR devices are affected by lack of access control at the function level. This affects J Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. The TFTP firmware update mechanism does not properly implement firmware validations, allowing remote attackers to write arbitrary data to internal memory

CVE-2020-35783 [MEDIUM] CVE-2020-35783: Certain NETGEAR devices are affected by lack of access control at the function level. This affects J Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, GS116Ev2 before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and JGS524PE before 2.6.0.48. The NSDP protocol version allows unauthenticated remote attackers to obtain all the switch configuration parameters by sending the corresponding read r

CVE-2020-26919 [CRITICAL] CVE-2020-26919: NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function leve NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.

CVE-2017-18862 [MEDIUM] CWE-287 CVE-2017-18862: Certain NETGEAR devices are affected by authentication bypass. This affects JGS516PE before 2017-05- Certain NETGEAR devices are affected by authentication bypass. This affects JGS516PE before 2017-05-11, JGS524Ev2 before 2017-05-11, JGS524PE before 2017-05-11, GS105Ev2 before 2017-05-11, GS105PE before 2017-05-11, GS108Ev3 before 2017-05-11, GS108PEv3 before 2017-05-11, GS116Ev2 before 2017-05-11, GSS108E before 2017-05-11, GSS116E before 2017-05-

CVE-2020-11791 [MEDIUM] CWE-79 CVE-2020-11791: NETGEAR JGS516PE devices before 2.6.0.43 are affected by reflected XSS. NETGEAR JGS516PE devices before 2.6.0.43 are affected by reflected XSS.

CVE-2019-20676 [MEDIUM] CWE-862 CVE-2019-20676: Certain NETGEAR devices are affected by lack of access control at the function level. This affects F Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS724TPv2 before 1.1.1.29, GS808E before 1.7.0.7,

CVE-2019-20658 [MEDIUM] CVE-2019-20658: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects FS728TLP b Certain NETGEAR devices are affected by disclosure of sensitive information. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS808E before 1.7.0.7, GS810EMX before 1.7.1.1, GS908E before 1.7.