PT-2020-5877 · NetGear · Netgear Orbi Srk60

Published 2020-09-17 · Updated 2020-10-16 · CVE-2020-26920

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: NETGEAR Orbi SRK60 versions prior to 2.5.3.110 NETGEAR Orbi SRR60 versions prior to 2.5.3.110 NETGEAR Orbi SRS60 versions prior to 2.5.3.110

Description: The issue is related to insufficient input sanitization in the Wi-Fi system's firmware, allowing for command injection. This can be exploited by an unauthenticated attacker to execute arbitrary commands remotely.

Recommendations: For SRK60 versions prior to 2.5.3.110, update to version 2.5.3.110 or later. For SRR60 versions prior to 2.5.3.110, update to version 2.5.3.110 or later. For SRS60 versions prior to 2.5.3.110, update to version 2.5.3.110 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2021-01966

CVE-2020-26920

Affected Products

Netgear Orbi Srk60

References · 5

• https://osv.dev/vulnerability/CVE-2020-26920 · Vendor Advisory
• https://kb.netgear.com/000062333/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0327 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01966 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26920 · Security Note
• https://cxsecurity.com/cveshow/CVE-2020-26920 · Note