Sign-up

ID

VAR-202004-0490


CVE

CVE-2020-11781


TITLE

plural NETGEAR Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-004358

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, RBK50 before 2.3.5.30, XR500 before 2.3.2.56, and XR700 before 1.0.1.10. plural NETGEAR A cross-site scripting vulnerability exists in the device.Information may be obtained and tampered with. NETGEAR D7800, etc. are all products of NETGEAR. NETGEAR D7800 is a wireless modem. NETGEAR R7500 is a wireless router. NETGEAR XR500 is a wireless router. The vulnerability stems from the lack of proper verification of client data by WEB applications. Attackers can use this vulnerability to execute client code

Trust: 2.16

sources: NVD: CVE-2020-11781 // JVNDB: JVNDB-2020-004358 // CNVD: CNVD-2020-26940

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-26940

AFFECTED PRODUCTS

vendor:netgearmodel:rbr50scope:ltversion:2.3.5.30

Trust: 1.6

vendor:netgearmodel:rbs50scope:ltversion:2.3.5.30

Trust: 1.6

vendor:netgearmodel:rbk50scope:ltversion:2.3.5.30

Trust: 1.6

vendor:netgearmodel:r7800scope:ltversion:1.0.2.68

Trust: 1.6

vendor:netgearmodel:d7800scope:ltversion:1.0.1.56

Trust: 1.6

vendor:netgearmodel:r8900scope:ltversion:1.0.4.28

Trust: 1.6

vendor:netgearmodel:r9000scope:ltversion:1.0.4.28

Trust: 1.6

vendor:netgearmodel:rax120scope:ltversion:1.0.0.78

Trust: 1.6

vendor:netgearmodel:xr500scope:ltversion:2.3.2.56

Trust: 1.6

vendor:netgearmodel:xr700scope:ltversion:1.0.1.10

Trust: 1.6

vendor:netgearmodel:r7500scope:ltversion:1.0.3.46

Trust: 1.0

vendor:netgearmodel:d7800scope:eqversion:1.0.1.56

Trust: 0.8

vendor:netgearmodel:r7500scope:eqversion:1.0.3.46

Trust: 0.8

vendor:netgearmodel:r7800scope:eqversion:1.0.2.68

Trust: 0.8

vendor:netgearmodel:r8900scope:eqversion:1.0.4.28

Trust: 0.8

vendor:netgearmodel:r9000scope:eqversion:1.0.4.28

Trust: 0.8

vendor:netgearmodel:rax120scope:eqversion:1.0.0.78

Trust: 0.8

vendor:netgearmodel:rbk50scope:eqversion:2.3.5.30

Trust: 0.8

vendor:netgearmodel:rbr50scope:eqversion:2.3.5.30

Trust: 0.8

vendor:netgearmodel:rbs50scope:eqversion:2.3.5.30

Trust: 0.8

vendor:netgearmodel:xr500scope:eqversion:2.3.2.56

Trust: 0.8

vendor:netgearmodel:r7500v2scope:ltversion:1.0.3.46

Trust: 0.6

sources: CNVD: CNVD-2020-26940 // JVNDB: JVNDB-2020-004358 // NVD: CVE-2020-11781

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-11781
value: MEDIUM

Trust: 1.0

cve@mitre.org: CVE-2020-11781
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2020-004358
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2020-26940
value: LOW

Trust: 0.6

CNNVD: CNNVD-202004-1166
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2020-11781
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-004358
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-26940
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-11781
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 1.7
impactScore: 2.7
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2020-11781
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 5.2
version: 3.0

Trust: 1.0

NVD: JVNDB-2020-004358
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-26940 // JVNDB: JVNDB-2020-004358 // CNNVD: CNNVD-202004-1166 // NVD: CVE-2020-11781 // NVD: CVE-2020-11781

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2020-004358 // NVD: CVE-2020-11781

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-1166

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202004-1166

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-004358

PATCH
title:Security Advisory for Stored Cross Site Scripting on Some Routers, Gateways, and WiFi Systems, PSV-2018-0529url:https://kb.netgear.com/000061749/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2018-0529
Trust: 0.8
title:Patch for Multiple NETGEAR product cross-site scripting vulnerabilities (CNVD-2020-26940)url:https://www.cnvd.org.cn/patchInfo/show/216321
Trust: 0.6
title:Multiple NETGEAR Fixes for product cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=116480
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-26940 // 
            
            
            
            JVNDB: JVNDB-2020-004358 // 
            
            
            
            CNNVD: CNNVD-202004-1166

EXTERNAL IDS
db:NVDid:CVE-2020-11781
Trust: 3.0
db:JVNDBid:JVNDB-2020-004358
Trust: 0.8
db:CNVDid:CNVD-2020-26940
Trust: 0.6
db:CNNVDid:CNNVD-202004-1166
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-26940 // 
            
            
            
            JVNDB: JVNDB-2020-004358 // 
            
            
            
            CNNVD: CNNVD-202004-1166 // 
            
            
            
            NVD: CVE-2020-11781

REFERENCES
url:https://nvd.nist.gov/vuln/detail/cve-2020-11781
Trust: 2.0
url:https://kb.netgear.com/000061749/security-advisory-for-stored-cross-site-scripting-on-some-routers-gateways-and-wifi-systems-psv-2018-0529
Trust: 1.6
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-11781
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2020-26940 // 
            
            
            
            JVNDB: JVNDB-2020-004358 // 
            
            
            
            CNNVD: CNNVD-202004-1166 // 
            
            
            
            NVD: CVE-2020-11781

SOURCES
db:CNVDid:CNVD-2020-26940
db:JVNDBid:JVNDB-2020-004358
db:CNNVDid:CNNVD-202004-1166
db:NVDid:CVE-2020-11781

LAST UPDATE DATE
2024-11-23T22:44:37.411000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-26940date:2020-05-07T00:00:00
db:JVNDBid:JVNDB-2020-004358date:2020-05-13T00:00:00
db:CNNVDid:CNNVD-202004-1166date:2020-04-26T00:00:00
db:NVDid:CVE-2020-11781date:2024-11-21T04:58:36.473

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-26940date:2020-05-07T00:00:00
db:JVNDBid:JVNDB-2020-004358date:2020-05-13T00:00:00
db:CNNVDid:CNNVD-202004-1166date:2020-04-15T00:00:00
db:NVDid:CVE-2020-11781date:2020-04-15T16:15:16.893