Sign-up

ID

VAR-202010-0580


CVE

CVE-2020-26914


TITLE

plural  NETGEAR  Command injection vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-012217

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, and WNR2020 before 1.1.0.62. plural NETGEAR A command injection vulnerability exists in the device.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

Trust: 1.62

sources: NVD: CVE-2020-26914 // JVNDB: JVNDB-2020-012217

AFFECTED PRODUCTS

vendor:netgearmodel:r6050scope:ltversion:1.0.1.24

Trust: 1.0

vendor:netgearmodel:r6220scope:ltversion:1.1.0.100

Trust: 1.0

vendor:netgearmodel:d6200scope:ltversion:1.1.00.38

Trust: 1.0

vendor:netgearmodel:r6260scope:ltversion:1.1.0.64

Trust: 1.0

vendor:netgearmodel:r6700v2scope:ltversion:1.2.0.62

Trust: 1.0

vendor:netgearmodel:jr6150scope:ltversion:1.0.1.24

Trust: 1.0

vendor:netgearmodel:r6120scope:ltversion:1.0.0.66

Trust: 1.0

vendor:netgearmodel:d7000scope:ltversion:1.0.1.78

Trust: 1.0

vendor:netgearmodel:r6080scope:ltversion:1.0.0.42

Trust: 1.0

vendor:netgearmodel:r7450scope:ltversion:1.2.0.62

Trust: 1.0

vendor:netgearmodel:r6800scope:ltversion:1.2.0.62

Trust: 1.0

vendor:netgearmodel:wnr2020scope:ltversion:1.1.0.62

Trust: 1.0

vendor:netgearmodel:r6020scope:ltversion:1.0.0.42

Trust: 1.0

vendor:netgearmodel:r6900v2scope:ltversion:1.2.0.62

Trust: 1.0

vendor:ネットギアmodel:d6200scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:d7000scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:jr6150scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6020scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6050scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6080scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6120scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6220scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6260scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6700v2scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-012217 // NVD: CVE-2020-26914

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-26914
value: HIGH

Trust: 1.0

cve@mitre.org: CVE-2020-26914
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-26914
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202010-345
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-26914
severity: MEDIUM
baseScore: 5.2
vectorString: AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2020-26914
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2020-26914
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 1.2
impactScore: 5.5
version: 3.1

Trust: 1.0

NVD: CVE-2020-26914
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2020-012217 // CNNVD: CNNVD-202010-345 // NVD: CVE-2020-26914 // NVD: CVE-2020-26914

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:Command injection (CWE-77) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-012217 // NVD: CVE-2020-26914

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202010-345

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202010-345

PATCH

title:Security Advisory for Post-Authentication Command Injection on Some Routers, PSV-2019-0014url:https://kb.netgear.com/000062339/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2019-0014

Trust: 0.8

title:Multiple NETGEAR Fixes for device command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=131132

Trust: 0.6

sources: JVNDB: JVNDB-2020-012217 // CNNVD: CNNVD-202010-345

EXTERNAL IDS

db:NVDid:CVE-2020-26914

Trust: 2.4

db:JVNDBid:JVNDB-2020-012217

Trust: 0.8

db:CNNVDid:CNNVD-202010-345

Trust: 0.6

sources: JVNDB: JVNDB-2020-012217 // CNNVD: CNNVD-202010-345 // NVD: CVE-2020-26914

REFERENCES

url:https://kb.netgear.com/000062339/security-advisory-for-post-authentication-command-injection-on-some-routers-psv-2019-0014

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-26914

Trust: 1.4

sources: JVNDB: JVNDB-2020-012217 // CNNVD: CNNVD-202010-345 // NVD: CVE-2020-26914

SOURCES

db:JVNDBid:JVNDB-2020-012217
db:CNNVDid:CNNVD-202010-345
db:NVDid:CVE-2020-26914

LAST UPDATE DATE

2024-11-23T22:54:59.847000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2020-012217date:2021-04-27T05:42:00
db:CNNVDid:CNNVD-202010-345date:2020-10-21T00:00:00
db:NVDid:CVE-2020-26914date:2024-11-21T05:20:29.020

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2020-012217date:2021-04-27T00:00:00
db:CNNVDid:CNNVD-202010-345date:2020-10-09T00:00:00
db:NVDid:CVE-2020-26914date:2020-10-09T07:15:17.120