Details of VAR-202004-0795

ID

VAR-202004-0795

CVE

CVE-2019-20749

TITLE

plural NETGEAR Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-015436

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.47, EX6100v2 before 1.0.1.76, EX6150v2 before 1.0.1.76, R7500v2 before 1.0.3.38, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN2000RPTv3 before 1.0.1.32, WN3000RPv3 before 1.0.2.70, and WN3100RPv2 before 1.0.0.66. plural NETGEAR A cross-site scripting vulnerability exists in the device.Information may be obtained and tampered with. NETGEAR R8900 is a wireless router of NETGEAR. The vulnerability stems from the lack of proper verification of client data by WEB applications. Attackers can use this vulnerability to execute client code. This affects D7800 prior to 1.0.1.47, EX6100v2 prior to 1.0.1.76, EX6150v2 prior to 1.0.1.76, R7500v2 prior to 1.0.3.38, R7800 prior to 1.0.2.52, R8900 prior to 1.0.4.12, R9000 prior to 1.0.4.12, WN2000RPTv3 prior to 1.0.1.32, WN3000RPv3 prior to 1.0.2.70, and WN3100RPv2 prior to 1.0.0.66

Trust: 2.25

sources: NVD: CVE-2019-20749 // JVNDB: JVNDB-2019-015436 // CNVD: CNVD-2020-27301 // VULMON: CVE-2019-20749

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-27301

AFFECTED PRODUCTS

vendor:	netgear	model:	r7800	scope:	lt	version:	1.0.2.52	Trust: 1.6
vendor:	netgear	model:	r8900	scope:	lt	version:	1.0.4.12	Trust: 1.6
vendor:	netgear	model:	r9000	scope:	lt	version:	1.0.4.12	Trust: 1.6
vendor:	netgear	model:	d7800	scope:	lt	version:	1.0.1.47	Trust: 1.6
vendor:	netgear	model:	wn3000rp	scope:	lt	version:	1.0.2.70	Trust: 1.0
vendor:	netgear	model:	ex6150	scope:	lt	version:	1.0.1.76	Trust: 1.0
vendor:	netgear	model:	ex6100	scope:	lt	version:	1.0.1.76	Trust: 1.0
vendor:	netgear	model:	r7500	scope:	lt	version:	1.0.3.38	Trust: 1.0
vendor:	netgear	model:	wn3100rp	scope:	lt	version:	1.0.0.66	Trust: 1.0
vendor:	netgear	model:	wn2000rpt	scope:	lt	version:	1.0.1.32	Trust: 1.0
vendor:	netgear	model:	d7800	scope:	eq	version:	1.0.1.47	Trust: 0.8
vendor:	netgear	model:	ex6100	scope:	eq	version:	1.0.1.76	Trust: 0.8
vendor:	netgear	model:	ex6150	scope:	eq	version:	1.0.1.76	Trust: 0.8
vendor:	netgear	model:	r7500	scope:	eq	version:	1.0.3.38	Trust: 0.8
vendor:	netgear	model:	r7800	scope:	eq	version:	1.0.2.52	Trust: 0.8
vendor:	netgear	model:	r8900	scope:	eq	version:	1.0.4.12	Trust: 0.8
vendor:	netgear	model:	r9000	scope:	eq	version:	1.0.4.12	Trust: 0.8
vendor:	netgear	model:	wn2000rpt	scope:	eq	version:	1.0.1.32	Trust: 0.8
vendor:	netgear	model:	wn3000rp	scope:	eq	version:	1.0.2.70	Trust: 0.8
vendor:	netgear	model:	wn3100rp	scope:	eq	version:	1.0.0.66	Trust: 0.8
vendor:	netgear	model:	ex6100v2	scope:	lt	version:	1.0.1.76	Trust: 0.6
vendor:	netgear	model:	ex6150v2	scope:	lt	version:	1.0.1.76	Trust: 0.6
vendor:	netgear	model:	r7500v2	scope:	lt	version:	1.0.3.38	Trust: 0.6
vendor:	netgear	model:	wn2000rptv3	scope:	lt	version:	1.0.1.32	Trust: 0.6
vendor:	netgear	model:	wn3000rpv3	scope:	lt	version:	1.0.2.70	Trust: 0.6
vendor:	netgear	model:	wn3100rpv2	scope:	lt	version:	1.0.0.66	Trust: 0.6

sources: CNVD: CNVD-2020-27301 // JVNDB: JVNDB-2019-015436 // NVD: CVE-2019-20749

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-20749
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2019-20749
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2019-015436
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-27301
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202004-1360
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2019-20749
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2019-20749
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2019-015436
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-27301
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-20749
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2019-20749
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.0
Trust: 1.0
NVD:	JVNDB-2019-015436
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-27301 // VULMON: CVE-2019-20749 // JVNDB: JVNDB-2019-015436 // CNNVD: CNNVD-202004-1360 // NVD: CVE-2019-20749 // NVD: CVE-2019-20749

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2019-015436 // NVD: CVE-2019-20749

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-1360

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202004-1360

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015436

PATCH

title:	Security Advisory for Stored Cross Site Scripting on Some Gateways, Extenders, and Routers, PSV-2018-0172	url:	https://kb.netgear.com/000060965/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Gateways-Extenders-and-Routers-PSV-2018-0172	Trust: 0.8
title:	Patch for Multiple NETGEAR product cross-site scripting vulnerabilities (CNVD-2020-27301)	url:	https://www.cnvd.org.cn/patchInfo/show/216923	Trust: 0.6
title:	Multiple NETGEAR Fixes for product cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=115004	Trust: 0.6

sources: CNVD: CNVD-2020-27301 // JVNDB: JVNDB-2019-015436 // CNNVD: CNNVD-202004-1360

EXTERNAL IDS

db:	NVD	id:	CVE-2019-20749	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-015436	Trust: 0.8
db:	CNVD	id:	CNVD-2020-27301	Trust: 0.6
db:	CNNVD	id:	CNNVD-202004-1360	Trust: 0.6
db:	VULMON	id:	CVE-2019-20749	Trust: 0.1

sources: CNVD: CNVD-2020-27301 // VULMON: CVE-2019-20749 // JVNDB: JVNDB-2019-015436 // CNNVD: CNNVD-202004-1360 // NVD: CVE-2019-20749

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2019-20749	Trust: 2.0
url:	https://kb.netgear.com/000060965/security-advisory-for-stored-cross-site-scripting-on-some-gateways-extenders-and-routers-psv-2018-0172	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20749	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/79.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2020-27301 // VULMON: CVE-2019-20749 // JVNDB: JVNDB-2019-015436 // CNNVD: CNNVD-202004-1360 // NVD: CVE-2019-20749

SOURCES

db:	CNVD	id:	CNVD-2020-27301
db:	VULMON	id:	CVE-2019-20749
db:	JVNDB	id:	JVNDB-2019-015436
db:	CNNVD	id:	CNNVD-202004-1360
db:	NVD	id:	CVE-2019-20749

LAST UPDATE DATE

2024-11-23T23:01:24.973000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-27301	date:	2020-05-09T00:00:00
db:	VULMON	id:	CVE-2019-20749	date:	2020-04-22T00:00:00
db:	JVNDB	id:	JVNDB-2019-015436	date:	2020-05-19T00:00:00
db:	CNNVD	id:	CNNVD-202004-1360	date:	2020-04-26T00:00:00
db:	NVD	id:	CVE-2019-20749	date:	2024-11-21T04:39:15.690

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-27301	date:	2020-05-09T00:00:00
db:	VULMON	id:	CVE-2019-20749	date:	2020-04-16T00:00:00
db:	JVNDB	id:	JVNDB-2019-015436	date:	2020-05-19T00:00:00
db:	CNNVD	id:	CNNVD-202004-1360	date:	2020-04-16T00:00:00
db:	NVD	id:	CVE-2019-20749	date:	2020-04-16T21:15:12.923