Details of VAR-202004-0782

ID

VAR-202004-0782

CVE

CVE-2019-20720

TITLE

plural NETGEAR Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-015407

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D7800 before 1.0.1.47, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN2000RPTv3 before 1.0.1.32, WN3000RPv3 before 1.0.2.70, and WN3100RPv2 before 1.0.0.66. plural NETGEAR A cross-site scripting vulnerability exists in the device.Information may be obtained and tampered with. NETGEAR D3600, etc. are all wireless modems from NETGEAR. The vulnerability stems from the lack of correct verification of client data in WEB applications. An attacker can use this vulnerability to execute client code. This affects D3600 prior to 1.0.0.76, D6000 prior to 1.0.0.76, D7800 prior to 1.0.1.47, R7500v2 prior to 1.0.3.38, R7800 prior to 1.0.2.52, R8900 prior to 1.0.4.12, R9000 prior to 1.0.4.12, WN2000RPTv3 prior to 1.0.1.32, WN3000RPv3 prior to 1.0.2.70, and WN3100RPv2 prior to 1.0.0.66

Trust: 2.25

sources: NVD: CVE-2019-20720 // JVNDB: JVNDB-2019-015407 // CNVD: CNVD-2021-63377 // VULMON: CVE-2019-20720

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-63377

AFFECTED PRODUCTS

vendor:	netgear	model:	r7800	scope:	lt	version:	1.0.2.52	Trust: 1.6
vendor:	netgear	model:	r8900	scope:	lt	version:	1.0.4.12	Trust: 1.6
vendor:	netgear	model:	r9000	scope:	lt	version:	1.0.4.12	Trust: 1.6
vendor:	netgear	model:	d3600	scope:	lt	version:	1.0.0.76	Trust: 1.6
vendor:	netgear	model:	d6000	scope:	lt	version:	1.0.0.76	Trust: 1.6
vendor:	netgear	model:	d7800	scope:	lt	version:	1.0.1.47	Trust: 1.6
vendor:	netgear	model:	wn3000rp	scope:	lt	version:	1.0.2.70	Trust: 1.0
vendor:	netgear	model:	r7500	scope:	lt	version:	1.0.3.38	Trust: 1.0
vendor:	netgear	model:	wn3100rp	scope:	lt	version:	1.0.0.66	Trust: 1.0
vendor:	netgear	model:	wn2000rpt	scope:	lt	version:	1.0.1.32	Trust: 1.0
vendor:	netgear	model:	d3600	scope:	eq	version:	1.0.0.76	Trust: 0.8
vendor:	netgear	model:	d6000	scope:	eq	version:	1.0.0.76	Trust: 0.8
vendor:	netgear	model:	d7800	scope:	eq	version:	1.0.1.47	Trust: 0.8
vendor:	netgear	model:	r7500	scope:	eq	version:	1.0.3.38	Trust: 0.8
vendor:	netgear	model:	r7800	scope:	eq	version:	1.0.2.52	Trust: 0.8
vendor:	netgear	model:	r8900	scope:	eq	version:	1.0.4.12	Trust: 0.8
vendor:	netgear	model:	r9000	scope:	eq	version:	1.0.4.12	Trust: 0.8
vendor:	netgear	model:	wn2000rpt	scope:	eq	version:	1.0.1.32	Trust: 0.8
vendor:	netgear	model:	wn3000rp	scope:	eq	version:	1.0.2.70	Trust: 0.8
vendor:	netgear	model:	wn3100rp	scope:	eq	version:	1.0.0.66	Trust: 0.8
vendor:	netgear	model:	r7500v2	scope:	lt	version:	1.0.3.38	Trust: 0.6
vendor:	netgear	model:	wn2000rptv3	scope:	lt	version:	1.0.1.32	Trust: 0.6
vendor:	netgear	model:	wn3000rpv3	scope:	lt	version:	1.0.2.70	Trust: 0.6
vendor:	netgear	model:	wn3100rpv2	scope:	lt	version:	1.0.0.66	Trust: 0.6

sources: CNVD: CNVD-2021-63377 // JVNDB: JVNDB-2019-015407 // NVD: CVE-2019-20720

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-20720
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2019-20720
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2019-015407
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2021-63377
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202004-1304
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2019-20720
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2019-20720
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2019-015407
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2021-63377
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-20720
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2019-20720
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.0
Trust: 1.0
NVD:	JVNDB-2019-015407
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-63377 // VULMON: CVE-2019-20720 // JVNDB: JVNDB-2019-015407 // CNNVD: CNNVD-202004-1304 // NVD: CVE-2019-20720 // NVD: CVE-2019-20720

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2019-015407 // NVD: CVE-2019-20720

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-1304

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202004-1304

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015407

PATCH

title:	Security Advisory for Stored Cross Site Scripting on Some Routers and Gateways, PSV-2018-0174	url:	https://kb.netgear.com/000061208/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2018-0174	Trust: 0.8
title:	Patch for Cross-site scripting vulnerabilities in multiple NETGEAR products (CNVD-2021-63377)	url:	https://www.cnvd.org.cn/patchInfo/show/287131	Trust: 0.6
title:	Multiple NETGEAR Fixes for product cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=116883	Trust: 0.6

sources: CNVD: CNVD-2021-63377 // JVNDB: JVNDB-2019-015407 // CNNVD: CNNVD-202004-1304

EXTERNAL IDS

db:	NVD	id:	CVE-2019-20720	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-015407	Trust: 0.8
db:	CNVD	id:	CNVD-2021-63377	Trust: 0.6
db:	CNNVD	id:	CNNVD-202004-1304	Trust: 0.6
db:	VULMON	id:	CVE-2019-20720	Trust: 0.1

sources: CNVD: CNVD-2021-63377 // VULMON: CVE-2019-20720 // JVNDB: JVNDB-2019-015407 // CNNVD: CNNVD-202004-1304 // NVD: CVE-2019-20720

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2019-20720	Trust: 2.0
url:	https://kb.netgear.com/000061208/security-advisory-for-stored-cross-site-scripting-on-some-routers-and-gateways-psv-2018-0174	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20720	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2021-63377 // VULMON: CVE-2019-20720 // JVNDB: JVNDB-2019-015407 // CNNVD: CNNVD-202004-1304 // NVD: CVE-2019-20720

CREDITS

aircut

Trust: 0.6

sources: CNNVD: CNNVD-202004-1304

SOURCES

db:	CNVD	id:	CNVD-2021-63377
db:	VULMON	id:	CVE-2019-20720
db:	JVNDB	id:	JVNDB-2019-015407
db:	CNNVD	id:	CNNVD-202004-1304
db:	NVD	id:	CVE-2019-20720

LAST UPDATE DATE

2024-11-23T22:44:36.842000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-63377	date:	2021-08-19T00:00:00
db:	VULMON	id:	CVE-2019-20720	date:	2020-04-22T00:00:00
db:	JVNDB	id:	JVNDB-2019-015407	date:	2020-05-19T00:00:00
db:	CNNVD	id:	CNNVD-202004-1304	date:	2020-04-26T00:00:00
db:	NVD	id:	CVE-2019-20720	date:	2024-11-21T04:39:10.797

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-63377	date:	2020-08-19T00:00:00
db:	VULMON	id:	CVE-2019-20720	date:	2020-04-16T00:00:00
db:	JVNDB	id:	JVNDB-2019-015407	date:	2020-05-19T00:00:00
db:	CNNVD	id:	CNNVD-202004-1304	date:	2020-04-16T00:00:00
db:	NVD	id:	CVE-2019-20720	date:	2020-04-16T19:15:25.150