Sign-up

ID

VAR-202012-1189


CVE

CVE-2020-35790


TITLE

plural  NETGEAR  Command injection vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2020-014982

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 before 1.0.4.26, and R9000 before 1.0.4.26. plural NETGEAR A command injection vulnerability exists in the device.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. NETGEAR D7800 is an AC2600 WiFi VDSL/ADSL modem router. NETGEAR R7800 is an AC2600 dual-band Gigabit wireless router. NETGEAR R8900 is a Nighthawk X10 AD7000 smart WiFi router. NETGEAR R9000 is a Nighthawk X10 AD7200 smart WiFi router. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2020-35790 // JVNDB: JVNDB-2020-014982 // CNVD: CNVD-2021-03351

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-03351

AFFECTED PRODUCTS

vendor:netgearmodel:r7800scope:ltversion:1.0.2.68

Trust: 1.6

vendor:netgearmodel:d7800scope:ltversion:1.0.1.56

Trust: 1.6

vendor:netgearmodel:r9000scope:ltversion:1.0.4.26

Trust: 1.6

vendor:netgearmodel:r8900scope:ltversion:1.0.4.26

Trust: 1.6

vendor:ネットギアmodel:r8900scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r7800scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r9000scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:d7800scope: - version: -

Trust: 0.8

sources: CNVD: CNVD-2021-03351 // JVNDB: JVNDB-2020-014982 // NVD: CVE-2020-35790

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-35790
value: MEDIUM

Trust: 1.0

cve@mitre.org: CVE-2020-35790
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-35790
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2021-03351
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202012-1800
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2020-35790
severity: MEDIUM
baseScore: 5.2
vectorString: AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2021-03351
severity: MEDIUM
baseScore: 5.2
vectorString: AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-35790
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2020-35790
baseSeverity: MEDIUM
baseScore: 6.4
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 0.9
impactScore: 5.5
version: 3.1

Trust: 1.0

NVD: CVE-2020-35790
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-03351 // JVNDB: JVNDB-2020-014982 // CNNVD: CNNVD-202012-1800 // NVD: CVE-2020-35790 // NVD: CVE-2020-35790

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:Command injection (CWE-77) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-014982 // NVD: CVE-2020-35790

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202012-1800

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202012-1800

PATCH

title:Security Advisory for Post-Authentication Command Injection on Some Routers, PSV-2018-0571url:https://kb.netgear.com/000062639/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0571

Trust: 0.8

title:Patch for NETGEAR D7800/R7800/R8900/R9000 command injection vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/243712

Trust: 0.6

title:Multiple NETGEAR Fixes for device command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=138291

Trust: 0.6

sources: CNVD: CNVD-2021-03351 // JVNDB: JVNDB-2020-014982 // CNNVD: CNNVD-202012-1800

EXTERNAL IDS

db:NVDid:CVE-2020-35790

Trust: 3.0

db:JVNDBid:JVNDB-2020-014982

Trust: 0.8

db:CNVDid:CNVD-2021-03351

Trust: 0.6

db:CNNVDid:CNNVD-202012-1800

Trust: 0.6

sources: CNVD: CNVD-2021-03351 // JVNDB: JVNDB-2020-014982 // CNNVD: CNNVD-202012-1800 // NVD: CVE-2020-35790

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2020-35790

Trust: 2.0

url:https://kb.netgear.com/000062639/security-advisory-for-post-authentication-command-injection-on-some-routers-psv-2018-0571

Trust: 1.6

sources: CNVD: CNVD-2021-03351 // JVNDB: JVNDB-2020-014982 // CNNVD: CNNVD-202012-1800 // NVD: CVE-2020-35790

SOURCES

db:CNVDid:CNVD-2021-03351
db:JVNDBid:JVNDB-2020-014982
db:CNNVDid:CNNVD-202012-1800
db:NVDid:CVE-2020-35790

LAST UPDATE DATE

2024-11-23T22:25:13.743000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-03351date:2021-07-15T00:00:00
db:JVNDBid:JVNDB-2020-014982date:2021-09-07T06:17:00
db:CNNVDid:CNNVD-202012-1800date:2021-01-05T00:00:00
db:NVDid:CVE-2020-35790date:2024-11-21T05:28:06.457

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-03351date:2020-12-29T00:00:00
db:JVNDBid:JVNDB-2020-014982date:2021-09-07T00:00:00
db:CNNVDid:CNNVD-202012-1800date:2020-12-29T00:00:00
db:NVDid:CVE-2020-35790date:2020-12-30T00:15:13.737