Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-17409

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020, JNR3210, and WNR2020 routers with firmware 1.0.66. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10754.

Published

2020-10-13T17:15:13.777

Last Modified

2024-11-21T05:08:02.343

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:A/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

6.5

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-288
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System netgear r6020_firmware < 1.0.0.44 Yes
Hardware netgear r6020 - No
Operating System netgear r6080_firmware < 1.0.0.44 Yes
Hardware netgear r6080 - No
Operating System netgear r6120_firmware < 1.0.0.70 Yes
Hardware netgear r6120 - No
Operating System netgear r6220_firmware < 1.1.0.100 Yes
Hardware netgear r6220 - No
Operating System netgear r6230_firmware < 1.1.0.100 Yes
Hardware netgear r6230 - No
Operating System netgear r6260_firmware < 1.1.0.76 Yes
Hardware netgear r6260 - No
Operating System netgear r6330_firmware < 1.1.0.76 Yes
Hardware netgear r6330 - No
Operating System netgear r6350_firmware < 1.1.0.76 Yes
Hardware netgear r6350 - No
Operating System netgear r6850_firmware < 1.1.0.76 Yes
Hardware netgear r6850 - No
Operating System netgear jnr3210_firmware - Yes
Hardware netgear jnr3210 - No
Operating System netgear wnr2020_firmware - Yes
Hardware netgear wnr2020 - No
References