PT-2020-12684 · NetGear · Netgear Pro Tri-Band Business Wifi Router+2

Thorsten Schroeder · Published 2020-05-18 · Updated 2021-07-21 · CVE-2020-11550

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AC:L/AV:A/A:N/C:H/I:N/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 version 2.5.1.106 NETGEAR Outdoor Satellite (RBS50Y) AC3000 version 2.5.1.106 NETGEAR Pro Tri-Band Business WiFi Router (SRR60) AC3000 version 2.5.1.106

Description An issue allows an unauthenticated remote leak of sensitive Wi-Fi information, such as SSIDs and Pre-Shared-Keys (PSK), through the administrative SOAP interface.

Recommendations For NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 version 2.5.1.106, consider disabling the administrative SOAP interface until a patch is available. For NETGEAR Outdoor Satellite (RBS50Y) AC3000 version 2.5.1.106, restrict access to the administrative SOAP interface to minimize the risk of exploitation. For NETGEAR Pro Tri-Band Business WiFi Router (SRR60) AC3000 version 2.5.1.106, avoid using the administrative SOAP interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-11550

Affected Products

Netgear Orbi Tri-Band Business Wifi Add-On Satellite

Netgear Outdoor Satellite

Netgear Pro Tri-Band Business Wifi Router

References · 6

• 🔥 https://github.com/modzero/MZ-20-02-NETGEAR-Orbi-Security · Exploit
• 🔥 https://modzero.com/advisories/MZ-20-02-Netgear-Orbi-Pro-Security.txt · Exploit
• 🔥 https://modzero.com/modlog/archives/2020/05/18/how_netgear_meshed_up_wifi_for_business/index.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11550 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11550 · Vendor Advisory
• https://t.me/cvenotify/3892 · Telegram Post