High severity · published Apr 16, 2020
CVE-2019-20694
Certain NETGEAR devices are affected by disclosure of sensitive information
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Certain NETGEAR devices are affected by disclosure of sensitive information. This affects GS728TP before 6.0.0.48, GS728TPPv2 before 6.0.0.48, GS728TPv2 before 6.0.0.48, GS752TPP before 6.0.0.48, and GS752TPv2 before 6.0.0.48.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GF
Gs728tp Firmware · Netgear
before 6.0.0.48; before 6.0.0.48 · source: NVD
GF
Gs728tpp Firmware · Netgear
before 6.0.0.48 · source: NVD
GF
Gs752tp Firmware · Netgear
before 6.0.0.48 · source: NVD
GF
Gs752tpp Firmware · Netgear
before 6.0.0.48 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-20694
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-20694
Vendor Advisory
https://kb.netgear.com/000061235/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Switches-PSV-2019-0059
More from Gs728tp Firmware
9.8
CVE-2021-33514
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as…
8.8
CVE-2021-41314
Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the…
8.8
CVE-2021-40866
Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the (disabled by default) /sqfs/bin/sccd daemon, which fails to…
8.8
CVE-2019-20697
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker
7.1
CVE-2021-40867
Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source IP address as an…