Details of VAR-202004-0910

ID

VAR-202004-0910

CVE

CVE-2019-20701

TITLE

plural NETGEAR On the device OS Command injection vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2019-015329

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, and XR500 before 2.3.2.32. NETGEAR D3600 , D6000 , XR500 On the device OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR XR500 and so on are all products of NETGEAR. NETGEAR XR500 is a wireless router. NETGEAR D3600 is a wireless modem. NETGEAR D6000 is a wireless modem. NETGEAR D3600 versions prior to 1.0.0.76, D6000 versions prior to 1.0.0.76 and XR500 versions prior to 2.3.2.32 have operating system command injection vulnerabilities. This vulnerability stems from the process of constructing operating system executable commands from external input data. By properly filtering the special characters and commands, the attacker can use the vulnerability to execute illegal operating system commands

Trust: 2.16

sources: NVD: CVE-2019-20701 // JVNDB: JVNDB-2019-015329 // CNVD: CNVD-2020-27256

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-27256

AFFECTED PRODUCTS

vendor:	netgear	model:	xr500	scope:	lt	version:	2.3.2.32	Trust: 1.6
vendor:	netgear	model:	d3600	scope:	lt	version:	1.0.0.76	Trust: 1.6
vendor:	netgear	model:	d6000	scope:	lt	version:	1.0.0.76	Trust: 1.6
vendor:	netgear	model:	d3600	scope:	eq	version:	1.0.0.76	Trust: 0.8
vendor:	netgear	model:	d6000	scope:	eq	version:	1.0.0.76	Trust: 0.8
vendor:	netgear	model:	xr500	scope:	eq	version:	2.3.2.32	Trust: 0.8

sources: CNVD: CNVD-2020-27256 // JVNDB: JVNDB-2019-015329 // NVD: CVE-2019-20701

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-20701
value:	HIGH
Trust: 1.0
cve@mitre.org:	CVE-2019-20701
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2019-015329
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-27256
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202004-1285
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2019-20701
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2019-015329
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-27256
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-20701
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.1
impactScore:	5.9
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2019-20701
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 1.0
NVD:	JVNDB-2019-015329
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-27256 // JVNDB: JVNDB-2019-015329 // CNNVD: CNNVD-202004-1285 // NVD: CVE-2019-20701 // NVD: CVE-2019-20701

PROBLEMTYPE DATA

problemtype:	CWE-77	Trust: 1.0
problemtype:	CWE-78	Trust: 0.8

sources: JVNDB: JVNDB-2019-015329 // NVD: CVE-2019-20701

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202004-1285

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202004-1285

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-015329

PATCH

title:	Security Advisory for Post-Authentication Command Injection on Some Routers and Gateways, PSV-2018-0337	url:	https://kb.netgear.com/000061218/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Gateways-PSV-2018-0337	Trust: 0.8
title:	Patch for NETGEAR D3600, D6000 and XR500 operating system command injection vulnerability (CNVD-2020-27256)	url:	https://www.cnvd.org.cn/patchInfo/show/216919	Trust: 0.6
title:	NETGEAR D3600 , D6000 and XR500 Fixes for operating system command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=116555	Trust: 0.6

sources: CNVD: CNVD-2020-27256 // JVNDB: JVNDB-2019-015329 // CNNVD: CNNVD-202004-1285

EXTERNAL IDS

db:	NVD	id:	CVE-2019-20701	Trust: 3.0
db:	JVNDB	id:	JVNDB-2019-015329	Trust: 0.8
db:	CNVD	id:	CNVD-2020-27256	Trust: 0.6
db:	CNNVD	id:	CNNVD-202004-1285	Trust: 0.6

sources: CNVD: CNVD-2020-27256 // JVNDB: JVNDB-2019-015329 // CNNVD: CNNVD-202004-1285 // NVD: CVE-2019-20701

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2019-20701	Trust: 2.0
url:	https://kb.netgear.com/000061218/security-advisory-for-post-authentication-command-injection-on-some-routers-and-gateways-psv-2018-0337	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20701	Trust: 0.8

sources: CNVD: CNVD-2020-27256 // JVNDB: JVNDB-2019-015329 // CNNVD: CNNVD-202004-1285 // NVD: CVE-2019-20701

CREDITS

Mongo

Trust: 0.6

sources: CNNVD: CNNVD-202004-1285

SOURCES

db:	CNVD	id:	CNVD-2020-27256
db:	JVNDB	id:	JVNDB-2019-015329
db:	CNNVD	id:	CNNVD-202004-1285
db:	NVD	id:	CVE-2019-20701

LAST UPDATE DATE

2024-11-23T22:58:19.046000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-27256	date:	2020-05-09T00:00:00
db:	JVNDB	id:	JVNDB-2019-015329	date:	2020-05-12T00:00:00
db:	CNNVD	id:	CNNVD-202004-1285	date:	2020-04-26T00:00:00
db:	NVD	id:	CVE-2019-20701	date:	2024-11-21T04:39:07.180

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-27256	date:	2020-05-09T00:00:00
db:	JVNDB	id:	JVNDB-2019-015329	date:	2020-05-12T00:00:00
db:	CNNVD	id:	CNNVD-202004-1285	date:	2020-04-16T00:00:00
db:	NVD	id:	CVE-2019-20701	date:	2020-04-16T19:15:24.010