PT-2020-5882 · NetGear · Netgear Wc7600+3

Ghost_Fh · Published 2020-09-17 · Updated 2020-10-15 · CVE-2020-26922

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NETGEAR WC7500 versions prior to 6.5.5.24 NETGEAR WC7600 versions prior to 6.5.5.24 NETGEAR WC7600v2 versions prior to 6.5.5.24 NETGEAR WC9500 versions prior to 6.5.5.24

Description: The issue is related to insufficient input data validation, which can be exploited to execute arbitrary commands by an authenticated user. This allows an attacker to potentially gain control over the affected devices.

Recommendations: For NETGEAR WC7500 versions prior to 6.5.5.24, update to version 6.5.5.24 or later. For NETGEAR WC7600 versions prior to 6.5.5.24, update to version 6.5.5.24 or later. For NETGEAR WC7600v2 versions prior to 6.5.5.24, update to version 6.5.5.24 or later. For NETGEAR WC9500 versions prior to 6.5.5.24, update to version 6.5.5.24 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2021-01971

CVE-2020-26922

Affected Products

Netgear Wc7500

Netgear Wc7600

Netgear Wc7600V2

Netgear Wc9500

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-26922 · Security Note
• https://kb.netgear.com/000062330/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Wireless-Controllers-PSV-2020-0139 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01971 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26922 · Vendor Advisory
• https://cxsecurity.com/cveshow/CVE-2020-26922 · Note