PT-2020-12850 · NetGear · Netgear Rax120+3

Published 2020-04-15 · Updated 2020-04-21 · CVE-2020-11792

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR R8900 versions prior to 2020-01-20 NETGEAR R9000 versions prior to 2020-01-20 NETGEAR RAX120 versions prior to 2020-01-20 NETGEAR XR700 versions prior to 2020-01-20

Description The issue concerns the disclosure of Transport Layer Security (TLS) certificate private keys. This affects NETGEAR devices, including R8900, R9000, RAX120, and XR700 models, with versions prior to 2020-01-20.

Recommendations For NETGEAR R8900 versions prior to 2020-01-20, update the device to a version released after 2020-01-20. For NETGEAR R9000 versions prior to 2020-01-20, update the device to a version released after 2020-01-20. For NETGEAR RAX120 versions prior to 2020-01-20, update the device to a version released after 2020-01-20. For NETGEAR XR700 versions prior to 2020-01-20, update the device to a version released after 2020-01-20.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-11792

Affected Products

Netgear R8900

Netgear R9000

Netgear Rax120

Netgear Xr700

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-11792 · Security Note
• https://kb.netgear.com/000061582/Security-Advisory-for-Signed-TLS-Certificate-Private-Key-Disclosure-on-Some-Routers-PSV-2020-0105 · Vendor Advisory
• https://t.me/cvenotify/2810 · Telegram Post