Login Request a demo
Medium severity · published Apr 15, 2020
CVE-2019-20676
Certain NETGEAR devices are affected by lack of access control at the function level
6.0
CVSS
0.3%
EPSS
No
On KEV
Description
Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS724TPv2 before 1.1.1.29, GS808E before 1.7.0.7, GS810EMX before 1.7.1.1, GS908E before 1.7.0.3, GSS108E before 1.6.0.4, GSS108EPP before 1.0.0.15, GSS116E before 1.6.0.9, JGS516PE before 2.6.0.35, JGS524Ev2 before 2.6.0.35, JGS524PE before 2.6.0.35, XS512EM before 1.0.1.1, XS708Ev2 before 1.6.0.23, XS716E before 1.6.0.23, and XS724EM before 1.0.1.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fs728tlp Firmware · Netgear
before 1.0.1.26 · source: NVD
GF
Gs105e Firmware · Netgear
before 1.6.0.4 · source: NVD
GF
Gs105pe Firmware · Netgear
before 1.6.0.4 · source: NVD
GF
Gs108e Firmware · Netgear
before 2.06.08 · source: NVD
GF
Gs108pe Firmware · Netgear
before 2.06.08 · source: NVD
GF
Gs110emx Firmware · Netgear
before 1.0.1.4 · source: NVD
GF
Gs116e Firmware · Netgear
before 2.6.0.35 · source: NVD
GF
Gs408epp Firmware · Netgear
before 1.0.0.15 · source: NVD
GF
Gs724tp Firmware · Netgear
before 1.1.1.29 · source: NVD
GF
Gs808e Firmware · Netgear
before 1.7.0.7 · source: NVD
GF
Gs810emx Firmware · Netgear
before 1.7.1.1 · source: NVD
GF
Gs908e Firmware · Netgear
before 1.7.0.3 · source: NVD
Affected product
FF
Fs728tlp Firmware
Netgear
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-20676
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-20676
Vendor Advisory
https://kb.netgear.com/000061463/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Switches-PSV-2018-0542
More from Fs728tlp Firmware
6.5
CVE-2019-20658
Certain NETGEAR devices are affected by disclosure of sensitive information