Netgear XR700 Stored cross site scripting

Summaryinfo

A vulnerability was found in Netgear D7800, R7500v2, R7800, R8900, R9000, RAX120, RBR20, RBS20, RBK20, RBR40, RBS40, RBK40, RBK50, RBS50, RBK50, XR500 and XR700. It has been declared as problematic. Impacted is an unknown function. Executing a manipulation can lead to cross site scripting (Stored). This vulnerability is handled as CVE-2020-11782. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Netgear D7800, R7500v2, R7800, R8900, R9000, RAX120, RBR20, RBS20, RBK20, RBR40, RBS40, RBK40, RBK50, RBS50, RBK50, XR500 and XR700 (Wireless LAN Software) and classified as problematic. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a cross site scripting vulnerability (Stored). The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity. CVE summarizes:

Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, XR500 before 2.3.2.56, and XR700 before 1.0.1.10.

The weakness was released 04/15/2020 (Website). The advisory is shared for download at kb.netgear.com. This vulnerability was named CVE-2020-11782 since 04/15/2020. The attack can be initiated remotely. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-153800, VDB-153799, VDB-153798 and VDB-153797. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• D7800
• R7500v2
• R7800
• R8900
• R9000
• RAX120
• RBK20
• RBK40
• RBK50
• RBK50
• RBR20
• RBR40
• RBS20
• RBS40
• RBS50
• XR500
• XR700

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion