Details of VAR-202010-0572

ID

VAR-202010-0572

CVE

CVE-2020-26906

TITLE

plural NETGEAR Inadequate protection of credentials on devices Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-012276

DESCRIPTION

Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11. plural NETGEAR The device contains a vulnerability related to insufficient protection of credentials.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. This affects CBR40 prior to 2.5.0.10, RBK752 prior to 3.2.15.25, RBR750 prior to 3.2.15.25, RBS750 prior to 3.2.15.25, RBK852 prior to 3.2.10.11, RBR850 prior to 3.2.10.11, and RBS850 prior to 3.2.10.11

Trust: 1.71

sources: NVD: CVE-2020-26906 // JVNDB: JVNDB-2020-012276 // VULMON: CVE-2020-26906

AFFECTED PRODUCTS

vendor:	netgear	model:	rbk852	scope:	lt	version:	3.2.10.11	Trust: 1.0
vendor:	netgear	model:	rbr750	scope:	lt	version:	3.2.15.25	Trust: 1.0
vendor:	netgear	model:	cbr40	scope:	lt	version:	2.5.0.10	Trust: 1.0
vendor:	netgear	model:	rbk752	scope:	lt	version:	3.2.15.25	Trust: 1.0
vendor:	netgear	model:	rbs850	scope:	lt	version:	3.2.10.11	Trust: 1.0
vendor:	netgear	model:	rbs750	scope:	lt	version:	3.2.15.25	Trust: 1.0
vendor:	netgear	model:	rbr850	scope:	lt	version:	3.2.10.11	Trust: 1.0
vendor:	ネットギア	model:	cbr40	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbk752	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbk852	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbr750	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbr850	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbs750	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbs850	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-012276 // NVD: CVE-2020-26906

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-26906
value:	HIGH
Trust: 1.0
cve@mitre.org:	CVE-2020-26906
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2020-26906
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202010-337
value:	HIGH
Trust: 0.6
VULMON:	CVE-2020-26906
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2020-26906
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

nvd@nist.gov:	CVE-2020-26906
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2020-26906
baseSeverity:	CRITICAL
baseScore:	9.6
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	6.0
version:	3.1
Trust: 1.0
NVD:	CVE-2020-26906
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2020-26906 // JVNDB: JVNDB-2020-012276 // CNNVD: CNNVD-202010-337 // NVD: CVE-2020-26906 // NVD: CVE-2020-26906

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Inadequate protection of credentials (CWE-522) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-012276 // NVD: CVE-2020-26906

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202010-337

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202010-337

PATCH

title:	Security Advisory for Admin Credential Disclosure on Some WiFi Systems, PSV-2020-0048	url:	https://kb.netgear.com/000062348/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0048	Trust: 0.8
title:	Multiple NETGEAR Repair measures for device security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=131124	Trust: 0.6

sources: JVNDB: JVNDB-2020-012276 // CNNVD: CNNVD-202010-337

EXTERNAL IDS

db:	NVD	id:	CVE-2020-26906	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-012276	Trust: 0.8
db:	CNNVD	id:	CNNVD-202010-337	Trust: 0.6
db:	VULMON	id:	CVE-2020-26906	Trust: 0.1

sources: VULMON: CVE-2020-26906 // JVNDB: JVNDB-2020-012276 // CNNVD: CNNVD-202010-337 // NVD: CVE-2020-26906

REFERENCES

url:	https://kb.netgear.com/000062348/security-advisory-for-admin-credential-disclosure-on-some-wifi-systems-psv-2020-0048	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2020-26906	Trust: 1.4
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2020-26906 // JVNDB: JVNDB-2020-012276 // CNNVD: CNNVD-202010-337 // NVD: CVE-2020-26906

SOURCES

db:	VULMON	id:	CVE-2020-26906
db:	JVNDB	id:	JVNDB-2020-012276
db:	CNNVD	id:	CNNVD-202010-337
db:	NVD	id:	CVE-2020-26906

LAST UPDATE DATE

2024-11-23T22:47:50.856000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2020-26906	date:	2021-07-21T00:00:00
db:	JVNDB	id:	JVNDB-2020-012276	date:	2021-04-28T07:36:00
db:	CNNVD	id:	CNNVD-202010-337	date:	2020-10-21T00:00:00
db:	NVD	id:	CVE-2020-26906	date:	2024-11-21T05:20:27.713

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2020-26906	date:	2020-10-09T00:00:00
db:	JVNDB	id:	JVNDB-2020-012276	date:	2021-04-28T00:00:00
db:	CNNVD	id:	CNNVD-202010-337	date:	2020-10-09T00:00:00
db:	NVD	id:	CVE-2020-26906	date:	2020-10-09T07:15:16.463