Details of VAR-202010-0584

ID

VAR-202010-0584

CVE

CVE-2020-26918

TITLE

plural NETGEAR Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-012277

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66, R6700v3 before 1.0.2.66, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.8, R8300 before 1.0.2.128, and R8500 before 1.0.2.128. plural NETGEAR A cross-site scripting vulnerability exists in the device.Information may be obtained and information may be tampered with

Trust: 1.62

sources: NVD: CVE-2020-26918 // JVNDB: JVNDB-2020-012277

AFFECTED PRODUCTS

vendor:	netgear	model:	ex7000	scope:	lt	version:	1.0.1.78	Trust: 1.0
vendor:	netgear	model:	r6700v3	scope:	lt	version:	1.0.2.66	Trust: 1.0
vendor:	netgear	model:	r6250	scope:	lt	version:	1.0.4.34	Trust: 1.0
vendor:	netgear	model:	r7900	scope:	lt	version:	1.0.3.8	Trust: 1.0
vendor:	netgear	model:	r6400	scope:	lt	version:	1.0.1.46	Trust: 1.0
vendor:	netgear	model:	r7100lg	scope:	lt	version:	1.0.0.50	Trust: 1.0
vendor:	netgear	model:	r7300dst	scope:	lt	version:	1.0.0.70	Trust: 1.0
vendor:	netgear	model:	r6400v2	scope:	lt	version:	1.0.2.66	Trust: 1.0
vendor:	netgear	model:	r8300	scope:	lt	version:	1.0.2.128	Trust: 1.0
vendor:	netgear	model:	r8500	scope:	lt	version:	1.0.2.128	Trust: 1.0
vendor:	ネットギア	model:	ex7000	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6250	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6400v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6400	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6700v3	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7100lg	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7300dst	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7900	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r8300	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r8500	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-012277 // NVD: CVE-2020-26918

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-26918
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2020-26918
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-26918
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202010-349
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2020-26918
severity:	LOW
baseScore:	3.5
vectorString:	AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2020-26918
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.7
impactScore:	2.7
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2020-26918
baseSeverity:	MEDIUM
baseScore:	4.1
vectorString:	CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	0.7
impactScore:	3.4
version:	3.1
Trust: 1.0
NVD:	CVE-2020-26918
baseSeverity:	MEDIUM
baseScore:	4.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2020-012277 // CNNVD: CNNVD-202010-349 // NVD: CVE-2020-26918 // NVD: CVE-2020-26918

PROBLEMTYPE DATA

problemtype:	CWE-79	Trust: 1.0
problemtype:	Cross-site scripting (CWE-79) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-012277 // NVD: CVE-2020-26918

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202010-349

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202010-349

PATCH

title:	Security Advisory for Stored Cross Site Scripting on Some Extenders and Routers, PSV-2018-0243	url:	https://kb.netgear.com/000062335/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-Routers-PSV-2018-0243	Trust: 0.8
title:	Multiple NETGEAR Fixes for device cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=131136	Trust: 0.6

sources: JVNDB: JVNDB-2020-012277 // CNNVD: CNNVD-202010-349

EXTERNAL IDS

db:	NVD	id:	CVE-2020-26918	Trust: 2.4
db:	JVNDB	id:	JVNDB-2020-012277	Trust: 0.8
db:	CNNVD	id:	CNNVD-202010-349	Trust: 0.6

sources: JVNDB: JVNDB-2020-012277 // CNNVD: CNNVD-202010-349 // NVD: CVE-2020-26918

REFERENCES

url:	https://kb.netgear.com/000062335/security-advisory-for-stored-cross-site-scripting-on-some-extenders-and-routers-psv-2018-0243	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-26918	Trust: 1.4

sources: JVNDB: JVNDB-2020-012277 // CNNVD: CNNVD-202010-349 // NVD: CVE-2020-26918

SOURCES

db:	JVNDB	id:	JVNDB-2020-012277
db:	CNNVD	id:	CNNVD-202010-349
db:	NVD	id:	CVE-2020-26918

LAST UPDATE DATE

2024-11-23T21:51:15.733000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2020-012277	date:	2021-04-28T07:36:00
db:	CNNVD	id:	CNNVD-202010-349	date:	2020-10-21T00:00:00
db:	NVD	id:	CVE-2020-26918	date:	2024-11-21T05:20:29.643

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2020-012277	date:	2021-04-28T00:00:00
db:	CNNVD	id:	CNNVD-202010-349	date:	2020-10-09T00:00:00
db:	NVD	id:	CVE-2020-26918	date:	2020-10-09T07:15:17.543