Medium severity · published Apr 15, 2020
CVE-2019-20658
Certain NETGEAR devices are affected by disclosure of sensitive information
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS808E before 1.7.0.7, GS810EMX before 1.7.1.1, GS908E before 1.7.0.3, GSS108E before 1.6.0.4, GSS108EPP before 1.0.0.15, GSS116E before 1.6.0.9, JGS516PE before 2.6.0.35, JGS524Ev2 before 2.6.0.35, JGS524PE before 2.6.0.35, XS512EM before 1.0.1.1, XS708Ev2 before 1.6.0.23, XS716E before 1.6.0.23, and XS724EM before 1.0.1.1.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fs728tlp Firmware · Netgear
before 1.0.1.26 · source: NVD
GF
Gs105e Firmware · Netgear
before 1.6.0.4 · source: NVD
GF
Gs105pe Firmware · Netgear
before 1.6.0.4 · source: NVD
GF
Gs108e Firmware · Netgear
before 2.06.08 · source: NVD
GF
Gs108pe Firmware · Netgear
before 2.06.08 · source: NVD
GF
Gs110emx Firmware · Netgear
before 1.0.1.4 · source: NVD
GF
Gs116e Firmware · Netgear
before 2.6.0.35 · source: NVD
GF
Gs408epp Firmware · Netgear
before 1.0.0.15 · source: NVD
GF
Gs808e Firmware · Netgear
before 1.7.0.7 · source: NVD
GF
Gs810emx Firmware · Netgear
before 1.7.1.1 · source: NVD
GF
Gs908e Firmware · Netgear
before 1.7.0.3 · source: NVD
GF
Gss108e Firmware · Netgear
before 1.6.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-20658
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-20658
Vendor Advisory
https://kb.netgear.com/000061481/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Switches-PSV-2018-0612
More from Fs728tlp Firmware
6.0
CVE-2019-20676
Certain NETGEAR devices are affected by lack of access control at the function level