PT-2020-10681 · NetGear · Netgear R7800+1

Published 2020-04-16 · Updated 2021-07-21 · CVE-2019-20706

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR R7800 versions 1.0.2.60 and earlier NETGEAR XR500 versions 2.3.2.32 and earlier

Description The issue allows command injection by an authenticated user.

Recommendations For NETGEAR R7800 versions 1.0.2.60 and earlier, update to version 1.0.2.60 or later. For NETGEAR XR500 versions 2.3.2.32 and earlier, update to version 2.3.2.32 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2019-20706

Affected Products

Netgear R7800

Netgear Xr500

References · 3

• https://kb.netgear.com/000061223/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-and-XR500-PSV-2018-0354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20706 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20706 · Vendor Advisory