Details of VAR-202010-0583

ID

VAR-202010-0583

CVE

CVE-2020-26917

TITLE

plural NETGEAR Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-012211

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.8, R8300 before 1.0.2.128, and R8500 before 1.0.2.128. plural NETGEAR A cross-site scripting vulnerability exists in the device.Information may be obtained and information may be tampered with

Trust: 1.62

sources: NVD: CVE-2020-26917 // JVNDB: JVNDB-2020-012211

AFFECTED PRODUCTS

vendor:	netgear	model:	ex7000	scope:	lt	version:	1.0.1.78	Trust: 1.0
vendor:	netgear	model:	r6250	scope:	lt	version:	1.0.4.34	Trust: 1.0
vendor:	netgear	model:	r7900	scope:	lt	version:	1.0.3.8	Trust: 1.0
vendor:	netgear	model:	r6400	scope:	lt	version:	1.0.1.46	Trust: 1.0
vendor:	netgear	model:	r7100lg	scope:	lt	version:	1.0.0.50	Trust: 1.0
vendor:	netgear	model:	r7300dst	scope:	lt	version:	1.0.0.70	Trust: 1.0
vendor:	netgear	model:	r6400v2	scope:	lt	version:	1.0.2.66	Trust: 1.0
vendor:	netgear	model:	r8300	scope:	lt	version:	1.0.2.128	Trust: 1.0
vendor:	netgear	model:	r8500	scope:	lt	version:	1.0.2.128	Trust: 1.0
vendor:	ネットギア	model:	ex7000	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6250	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6400v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6400	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7100lg	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7300dst	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7900	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r8300	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r8500	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-012211 // NVD: CVE-2020-26917

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-26917
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2020-26917
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-26917
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202010-348
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2020-26917
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2020-26917
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2020-26917
baseSeverity:	MEDIUM
baseScore:	4.1
vectorString:	CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	0.7
impactScore:	3.4
version:	3.1
Trust: 1.0
NVD:	CVE-2020-26917
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2020-012211 // CNNVD: CNNVD-202010-348 // NVD: CVE-2020-26917 // NVD: CVE-2020-26917

PROBLEMTYPE DATA

problemtype:	CWE-79	Trust: 1.0
problemtype:	Cross-site scripting (CWE-79) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-012211 // NVD: CVE-2020-26917

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202010-348

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202010-348

PATCH

title:	Security Advisory for Stored Cross Site Scripting on Some Extender and Routers, PSV-2018-0242	url:	https://kb.netgear.com/000062336/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extender-and-Routers-PSV-2018-0242	Trust: 0.8
title:	Multiple NETGEAR Fixes for device cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=131135	Trust: 0.6

sources: JVNDB: JVNDB-2020-012211 // CNNVD: CNNVD-202010-348

EXTERNAL IDS

db:	NVD	id:	CVE-2020-26917	Trust: 2.4
db:	JVNDB	id:	JVNDB-2020-012211	Trust: 0.8
db:	CNNVD	id:	CNNVD-202010-348	Trust: 0.6

sources: JVNDB: JVNDB-2020-012211 // CNNVD: CNNVD-202010-348 // NVD: CVE-2020-26917

REFERENCES

url:	https://kb.netgear.com/000062336/security-advisory-for-stored-cross-site-scripting-on-some-extender-and-routers-psv-2018-0242	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-26917	Trust: 1.4

sources: JVNDB: JVNDB-2020-012211 // CNNVD: CNNVD-202010-348 // NVD: CVE-2020-26917

SOURCES

db:	JVNDB	id:	JVNDB-2020-012211
db:	CNNVD	id:	CNNVD-202010-348
db:	NVD	id:	CVE-2020-26917

LAST UPDATE DATE

2024-11-23T22:16:18.429000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2020-012211	date:	2021-04-27T05:40:00
db:	CNNVD	id:	CNNVD-202010-348	date:	2020-10-21T00:00:00
db:	NVD	id:	CVE-2020-26917	date:	2024-11-21T05:20:29.493

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2020-012211	date:	2021-04-27T00:00:00
db:	CNNVD	id:	CNNVD-202010-348	date:	2020-10-09T00:00:00
db:	NVD	id:	CVE-2020-26917	date:	2020-10-09T07:15:17.387