PT-2020-10666 · NetGear · Netgear Ex3800+11

Published 2020-04-16 · Updated 2020-04-21 · CVE-2019-20691

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR D3600 versions prior to 1.0.0.72 NETGEAR D6000 versions prior to 1.0.0.72 NETGEAR EX3700 versions prior to 1.0.0.70 NETGEAR EX3800 versions prior to 1.0.0.70 NETGEAR EX6000 versions prior to 1.0.0.30 NETGEAR EX6100 versions prior to 1.0.2.24 NETGEAR EX6120 versions prior to 1.0.0.40 NETGEAR EX6130 versions prior to 1.0.0.22 NETGEAR EX6150v1 versions prior to 1.0.0.42 NETGEAR EX6200 versions prior to 1.0.3.88 NETGEAR EX7000 versions prior to 1.0.0.66 NETGEAR WN2500RPv2 versions prior to 1.0.1.54

Description The issue affects certain NETGEAR devices, making them susceptible to CSRF attacks.

Recommendations For NETGEAR D3600 version prior to 1.0.0.72, update to version 1.0.0.72 or later. For NETGEAR D6000 version prior to 1.0.0.72, update to version 1.0.0.72 or later. For NETGEAR EX3700 version prior to 1.0.0.70, update to version 1.0.0.70 or later. For NETGEAR EX3800 version prior to 1.0.0.70, update to version 1.0.0.70 or later. For NETGEAR EX6000 version prior to 1.0.0.30, update to version 1.0.0.30 or later. For NETGEAR EX6100 version prior to 1.0.2.24, update to version 1.0.2.24 or later. For NETGEAR EX6120 version prior to 1.0.0.40, update to version 1.0.0.40 or later. For NETGEAR EX6130 version prior to 1.0.0.22, update to version 1.0.0.22 or later. For NETGEAR EX6150v1 version prior to 1.0.0.42, update to version 1.0.0.42 or later. For NETGEAR EX6200 version prior to 1.0.3.88, update to version 1.0.3.88 or later. For NETGEAR EX7000 version prior to 1.0.0.66, update to version 1.0.0.66 or later. For NETGEAR WN2500RPv2 version prior to 1.0.1.54, update to version 1.0.1.54 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-20691

Affected Products

Netgear D3600

Netgear D6000

Netgear Ex3700

Netgear Ex3800

Netgear Ex6000

Netgear Ex6100

Netgear Ex6120

Netgear Ex6130

Netgear Ex6150V1

Netgear Ex6200

Netgear Ex7000

Netgear Wn2500Rpv2

References · 3

• https://kb.netgear.com/000061448/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Gateways-and-Extenders-PSV-2017-2747 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20691 · Security Note