PT-2020-17437 · NetGear · Nms300

Published 2020-12-29 · Updated 2021-07-21 · CVE-2020-35797

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR NMS300 versions prior to 1.6.0.27

Description The issue allows for command injection by an unauthenticated attacker.

Recommendations For versions prior to 1.6.0.27, update to version 1.6.0.27 or later to resolve the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-35797

Affected Products

Nms300

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-35797 · Security Note
• https://osv.dev/vulnerability/CVE-2020-35797 · Vendor Advisory
• https://kb.netgear.com/000062688/Security-Advisory-for-Pre-Authentication-Command-Injection-on-NMS300-PSV-2020-0560 · Vendor Advisory