ID

VAR-202006-0934


CVE

CVE-2020-14437


TITLE

plural NETGEAR On the device OS Command injection vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2020-006684

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25. plural NETGEAR On the device OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR RBK752, etc. are all home WiFi systems of NETGEAR. Attackers can use this vulnerability to execute arbitrary Shell commands on the system by sending a specially crafted request

Trust: 2.16

sources: NVD: CVE-2020-14437 // JVNDB: JVNDB-2020-006684 // CNVD: CNVD-2021-44782

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-44782

AFFECTED PRODUCTS

vendor:netgearmodel:rbk752scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbr750scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbs750scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbk753scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbk753sscope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbk842scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbr840scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbs840scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbk852scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbk853scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbr850scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbs850scope:ltversion:3.2.15.25

Trust: 1.6

vendor:netgearmodel:rbk752scope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbk753scope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbk753sscope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbk842scope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbk852scope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbk853scope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbr750scope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbr840scope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbs750scope:eqversion:3.2.15.25

Trust: 0.8

vendor:netgearmodel:rbs840scope:eqversion:3.2.15.25

Trust: 0.8

sources: CNVD: CNVD-2021-44782 // JVNDB: JVNDB-2020-006684 // NVD: CVE-2020-14437

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-14437
value: HIGH

Trust: 1.0

cve@mitre.org: CVE-2020-14437
value: CRITICAL

Trust: 1.0

NVD: JVNDB-2020-006684
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-44782
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202006-1253
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-14437
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-006684
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2021-44782
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-14437
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2020-14437
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 2.8
impactScore: 6.0
version: 3.0

Trust: 1.0

NVD: JVNDB-2020-006684
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-44782 // JVNDB: JVNDB-2020-006684 // CNNVD: CNNVD-202006-1253 // NVD: CVE-2020-14437 // NVD: CVE-2020-14437

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:CWE-78

Trust: 0.8

sources: JVNDB: JVNDB-2020-006684 // NVD: CVE-2020-14437

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202006-1253

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202006-1253

CONFIGURATIONS

[
  {
    "CVE_data_version": "4.0",
    "nodes": [
      {
        "operator": "OR",
        "cpe_match": [
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbk752_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbk753_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbk753s_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbk842_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbk852_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbk853_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbr750_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbr840_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbs750_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:rbs840_firmware"
          }
        ]
      }
    ]
  }
]

sources: JVNDB: JVNDB-2020-006684

PATCH

title:Security Advisory for Pre-Authentification Command Injection on Some WiFi Systems, PSV-2020-0054url:https://kb.netgear.com/000061940/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0054

Trust: 0.8

title:Patch for Operating system command injection vulnerabilities in multiple NETGEAR products (CNVD-2021-44782)url:https://www.cnvd.org.cn/patchInfo/show/275021

Trust: 0.6

sources: CNVD: CNVD-2021-44782 // JVNDB: JVNDB-2020-006684

EXTERNAL IDS

db:NVDid:CVE-2020-14437

Trust: 3.0

db:JVNDBid:JVNDB-2020-006684

Trust: 0.8

db:CNVDid:CNVD-2021-44782

Trust: 0.6

db:CNNVDid:CNNVD-202006-1253

Trust: 0.6

sources: CNVD: CNVD-2021-44782 // JVNDB: JVNDB-2020-006684 // CNNVD: CNNVD-202006-1253 // NVD: CVE-2020-14437

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2020-14437

Trust: 2.0

url:https://kb.netgear.com/000061940/security-advisory-for-pre-authentication-command-injection-on-some-wifi-systems-psv-2020-0054

Trust: 1.6

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-14437

Trust: 0.8

sources: CNVD: CNVD-2021-44782 // JVNDB: JVNDB-2020-006684 // CNNVD: CNNVD-202006-1253 // NVD: CVE-2020-14437

SOURCES

db:CNVDid:CNVD-2021-44782
db:JVNDBid:JVNDB-2020-006684
db:CNNVDid:CNNVD-202006-1253
db:NVDid:CVE-2020-14437

LAST UPDATE DATE

2024-11-23T22:41:00.813000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-44782date:2021-06-24T00:00:00
db:JVNDBid:JVNDB-2020-006684date:2020-07-15T00:00:00
db:CNNVDid:CNNVD-202006-1253date:2020-07-02T00:00:00
db:NVDid:CVE-2020-14437date:2024-11-21T05:03:16.423

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-44782date:2020-06-24T00:00:00
db:JVNDBid:JVNDB-2020-006684date:2020-07-15T00:00:00
db:CNNVDid:CNNVD-202006-1253date:2020-06-18T00:00:00
db:NVDid:CVE-2020-14437date:2020-06-18T17:15:12.860