Critical severity · published Apr 16, 2020
CVE-2019-20699
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS408EPP before 1.0.0.15, GS808E before 1.7.0.7, GS908E before 1.7.0.3, GSS108E before 1.6.0.4, and GSS108EPP before 1.0.0.15.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GF
Gs105e Firmware · Netgear
before 1.6.0.4 · source: NVD
GF
Gs105pe Firmware · Netgear
before 1.6.0.4 · source: NVD
GF
Gs408epp Firmware · Netgear
before 1.0.0.15 · source: NVD
GF
Gs808e Firmware · Netgear
before 1.7.0.7 · source: NVD
GF
Gs908e Firmware · Netgear
before 1.7.0.3 · source: NVD
GF
Gss108e Firmware · Netgear
before 1.6.0.4 · source: NVD
GF
Gss108epp Firmware · Netgear
before 1.0.0.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-20699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-20699
Vendor Advisory
https://kb.netgear.com/000061230/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Switches-PSV-2018-0538
More from Gs105e Firmware
6.5
CVE-2017-18862
Certain NETGEAR devices are affected by authentication bypass
6.5
CVE-2019-20658
Certain NETGEAR devices are affected by disclosure of sensitive information
6.0
CVE-2019-20676
Certain NETGEAR devices are affected by lack of access control at the function level