PT-2020-16821 · NetGear · Netgear R6220+13

1Sd3D · Published 2020-12-18 · Updated 2021-06-30 · CVE-2020-27866

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR R6020 versions (affected versions not specified) NETGEAR R6080 versions (affected versions not specified) NETGEAR R6120 versions (affected versions not specified) NETGEAR R6220 versions (affected versions not specified) NETGEAR R6260 versions (affected versions not specified) NETGEAR R6700v2 versions (affected versions not specified) NETGEAR R6800 versions (affected versions not specified) NETGEAR R6900v2 versions (affected versions not specified) NETGEAR R7450 versions (affected versions not specified) NETGEAR JNR3210 versions (affected versions not specified) NETGEAR WNR2020 versions (affected versions not specified) NETGEAR Nighthawk AC2100 versions (affected versions not specified) NETGEAR Nighthawk AC2400 versions (affected versions not specified)

Description This issue allows network-adjacent attackers to bypass authentication on affected NETGEAR router installations. The flaw exists within the mini httpd service, which listens on TCP port 80 by default, due to incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other issues to execute code in the context of root.

Recommendations For NETGEAR R6020, consider disabling the mini httpd service until a patch is available. For NETGEAR R6080, restrict access to protected pages to minimize the risk of exploitation. For NETGEAR R6120, avoid using the default TCP port 80 for the mini httpd service. For NETGEAR R6220, consider implementing additional authentication measures. For NETGEAR R6260, restrict access to the mini httpd service. For NETGEAR R6700v2, consider disabling access to protected pages. For NETGEAR R6800, implement strict access controls for the mini httpd service. For NETGEAR R6900v2, consider restricting access to the router's administration interface. For NETGEAR R7450, avoid using default settings for the mini httpd service. For NETGEAR JNR3210, consider implementing a web application firewall. For NETGEAR WNR2020, restrict access to the mini httpd service. For NETGEAR Nighthawk AC2100, consider disabling the mini httpd service. For NETGEAR Nighthawk AC2400, implement additional security measures to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-287

CWE-288

Related Identifiers

CVE-2020-27866

ZDI-20-1451

Affected Products

Netgear Jnr3210

Netgear Nighthawk Ac2100

Netgear Nighthawk Ac2400

Netgear R6020

Netgear R6080

Netgear R6120

Netgear R6220

Netgear R6260

Netgear R6700V2

Netgear R6800

Netgear R6900V2

Netgear R7450

Netgear Wnr2020

Mini Httpd

References · 8

• https://osv.dev/vulnerability/CVE-2020-27866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27866 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-1451 · Security Note
• https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers · Vendor Advisory
• https://t.me/cibsecurity/25827 · Telegram Post
• https://t.me/cvenotify/16925 · Telegram Post
• https://t.me/cvenotify/9837 · Telegram Post
• https://t.me/cybersecuritytechnologies/2888 · Telegram Post