Sign-up

ID

VAR-202003-0657


CVE

CVE-2019-20489


TITLE

NETGEAR WNR1000V4 Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-014727

DESCRIPTION

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FW_remote.htm&todo=cfg_init request without a cookie, reads the Set-Cookie header in the 401 Unauthorized response, and then repeats the FW_remote.htm&todo=cfg_init request with the specified cookie. NETGEAR WNR1000V4 A cross-site scripting vulnerability exists in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. A remote attacker could use the shell metacharacter in the sysDNSHost parameter to exploit this vulnerability to execute arbitrary commands. NETGEAR WNR1000V4 is a G54 / N150 wireless router

Trust: 2.7

sources: NVD: CVE-2019-20489 // JVNDB: JVNDB-2019-014727 // CNVD: CNVD-2020-15506 // CNVD: CNVD-2020-15505

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 1.2

sources: CNVD: CNVD-2020-15506 // CNVD: CNVD-2020-15505

AFFECTED PRODUCTS

vendor:netgearmodel:wnr1000v4scope:eqversion:1.1.0.54

Trust: 2.0

vendor:netgearmodel:wnr1000scope:eqversion:1.1.0.54

Trust: 1.0

sources: CNVD: CNVD-2020-15506 // CNVD: CNVD-2020-15505 // JVNDB: JVNDB-2019-014727 // NVD: CVE-2019-20489

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-20489
value: CRITICAL

Trust: 1.0

NVD: JVNDB-2019-014727
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2020-15506
value: HIGH

Trust: 0.6

CNVD: CNVD-2020-15505
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202003-028
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2019-20489
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2019-014727
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-15506
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2020-15505
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2019-20489
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2019-014727
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-15506 // CNVD: CNVD-2020-15505 // JVNDB: JVNDB-2019-014727 // CNNVD: CNNVD-202003-028 // NVD: CVE-2019-20489

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.0

problemtype:CWE-79

Trust: 0.8

sources: JVNDB: JVNDB-2019-014727 // NVD: CVE-2019-20489

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202003-028

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202003-028

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-014727

PATCH
title:WNR1000v4url:https://www.netgear.com/support/product/WNR1000v4.aspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2019-014727

EXTERNAL IDS
db:NVDid:CVE-2019-20489
Trust: 3.6
db:JVNDBid:JVNDB-2019-014727
Trust: 0.8
db:CNVDid:CNVD-2020-15506
Trust: 0.6
db:CNVDid:CNVD-2020-15505
Trust: 0.6
db:CNNVDid:CNNVD-202003-028
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-15506 // 
            
            
            
            CNVD: CNVD-2020-15505 // 
            
            
            
            JVNDB: JVNDB-2019-014727 // 
            
            
            
            CNNVD: CNNVD-202003-028 // 
            
            
            
            NVD: CVE-2019-20489

REFERENCES
url:https://nvd.nist.gov/vuln/detail/cve-2019-20489
Trust: 2.6
url:https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/
Trust: 2.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20489
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2020-15506 // 
            
            
            
            CNVD: CNVD-2020-15505 // 
            
            
            
            JVNDB: JVNDB-2019-014727 // 
            
            
            
            CNNVD: CNNVD-202003-028 // 
            
            
            
            NVD: CVE-2019-20489

SOURCES
db:CNVDid:CNVD-2020-15506
db:CNVDid:CNVD-2020-15505
db:JVNDBid:JVNDB-2019-014727
db:CNNVDid:CNNVD-202003-028
db:NVDid:CVE-2019-20489

LAST UPDATE DATE
2024-11-23T22:55:16.386000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-15506date:2020-03-05T00:00:00
db:CNVDid:CNVD-2020-15505date:2020-03-05T00:00:00
db:JVNDBid:JVNDB-2019-014727date:2020-03-12T00:00:00
db:CNNVDid:CNNVD-202003-028date:2020-08-25T00:00:00
db:NVDid:CVE-2019-20489date:2024-11-21T04:38:36.130

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-15506date:2020-03-05T00:00:00
db:CNVDid:CNVD-2020-15505date:2020-03-05T00:00:00
db:JVNDBid:JVNDB-2019-014727date:2020-03-12T00:00:00
db:CNNVDid:CNNVD-202003-028date:2020-03-02T00:00:00
db:NVDid:CVE-2019-20489date:2020-03-02T16:15:12.253