Lucene search

[email protected]NVD:CVE-2020-27872

HistoryFeb 04, 2021 - 5:15 p.m.

CVE-2020-27872

2021-02-0417:15:13

CWE-668

CWE-642

[email protected]

web.nvd.nist.gov

5.8 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

56.3%

JSON

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from improper state tracking in the password recovery process. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11365.

Affected configurations

NVD

Node

netgearac2100Match-

AND

netgearac2100_firmwareRange<1.2.0.76

Node

netgearac2400Match-

AND

netgearac2400_firmwareRange<1.2.0.76

Node

netgearac2600Match-

AND

netgearac2600_firmwareRange<1.2.0.76

Node

netgearr6700Matchv2

AND

netgearr6700_firmwareRange<1.2.0.76

Node

netgearr6800Match-

AND

netgearr6800_firmwareRange<1.2.0.76

Node

netgearr6900Matchv2

AND

netgearr6900_firmwareRange<1.2.0.76

Node

netgearr7200Match-

AND

netgearr7200_firmwareRange<1.2.0.76

Node

netgearr7350Match-

AND

netgearr7350_firmwareRange<1.2.0.76

Node

netgearr7400_firmwareRange<1.2.0.76

AND

netgearr7400Match-

Node

netgearr7450_firmwareRange<1.2.0.76

AND

netgearr7450Match-

Node

netgearr6220_firmwareRange<1.1.0.104

AND

netgearr6220Match-

Node

netgearr6230_firmwareRange<1.1.0.104

AND

netgearr6230Match-

Node

netgearr6260_firmwareRange<1.1.0.78

AND

netgearr6260Match-

Node

netgearr6330_firmwareRange<1.1.0.78

AND

netgearr6330Match-

Node

netgearr6350_firmwareRange<1.1.0.78

AND

netgearr6350Match-

Node

netgearr6850_firmwareRange<1.1.0.78

AND

netgearr6850Match-

Node

netgearr6120_firmwareRange<1.0.0.76

AND

netgearr6120Match-

Node

netgearr6020_firmwareRange<1.0.0.48

AND

netgearr6020Match-

Node

netgearr6080_firmwareRange<1.0.0.48

AND

netgearr6080Match-

References

kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers

www.zerodayinitiative.com/advisories/ZDI-21-071/

5.8 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

56.3%

JSON

Related for NVD:CVE-2020-27872

zdi1 cvelist1 cve1 cnvd1 prion1