PT-2020-10724 · NetGear · Ex6150V2+9

Published 2020-04-16 · Updated 2020-04-22 · CVE-2019-20749

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NETGEAR D7800 versions prior to 1.0.1.47 NETGEAR EX6100v2 versions prior to 1.0.1.76 NETGEAR EX6150v2 versions prior to 1.0.1.76 NETGEAR R7500v2 versions prior to 1.0.3.38 NETGEAR R7800 versions prior to 1.0.2.52 NETGEAR R8900 versions prior to 1.0.4.12 NETGEAR R9000 versions prior to 1.0.4.12 NETGEAR WN2000RPTv3 versions prior to 1.0.1.32 NETGEAR WN3000RPv3 versions prior to 1.0.2.70 NETGEAR WN3100RPv2 versions prior to 1.0.0.66

Description The issue is related to stored XSS, which affects certain NETGEAR devices.

Recommendations For D7800, update to version 1.0.1.47 or later. For EX6100v2, update to version 1.0.1.76 or later. For EX6150v2, update to version 1.0.1.76 or later. For R7500v2, update to version 1.0.3.38 or later. For R7800, update to version 1.0.2.52 or later. For R8900, update to version 1.0.4.12 or later. For R9000, update to version 1.0.4.12 or later. For WN2000RPTv3, update to version 1.0.1.32 or later. For WN3000RPv3, update to version 1.0.2.70 or later. For WN3100RPv2, update to version 1.0.0.66 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-20749

Affected Products

D7800

Ex6100V2

Ex6150V2

R7500V2

R7800

R8900

R9000

Wn2000Rptv3

Wn3000Rpv3

Wn3100Rpv2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-20749 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20749 · Vendor Advisory
• https://kb.netgear.com/000060965/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Gateways-Extenders-and-Routers-PSV-2018-0172 · Vendor Advisory