A vulnerability was found in Netgear D7000v2, R6220, R6260, R6700, R6700v2, R6800, R6900, R6900P, R6900v2, R7000, R7000P, R7800, R7900, R7900P, R8000, R8000P, R8300, R8500, R8900, R9000 and XR500 (Wireless LAN Software). It has been declared as critical. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7000v2 before 1.0.0.53, R6220 before 1.1.0.80, R6260 before 1.1.0.64, R6700 before 1.0.2.6, R6700v2 before 1.2.0.36, R6800 before 1.2.0.36, R6900 before 1.0.2.4, R6900P before 1.3.1.64, R6900v2 before 1.2.0.36, R7000 before 1.0.9.60, R7000P before 1.3.1.64, R7800 before 1.0.2.60, R7900 before 1.0.3.8, R7900P before 1.4.1.30, R8000 before 1.0.4.46, R8000P before 1.4.1.30, R8300 before 1.0.2.128, R8500 before 1.0.2.128, R8900 before 1.0.4.12, R9000 before 1.0.4.12, and XR500 before 2.3.2.32.

The weakness was released 04/15/2020 (Website). The advisory is shared for download at kb.netgear.com. This vulnerability was named CVE-2019-20680 since 04/15/2020. The attack can only be initiated within the local network. A single authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading eliminates this vulnerability.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• D7000v2
• R6220
• R6260
• R6700
• R6700v2
• R6800
• R6900
• R6900P
• R6900v2
• R7000
• R7000P
• R7800
• R7900
• R7900P
• R8000
• R8000P
• R8300
• R8500
• R8900
• R9000
• XR500

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion