Improper Authentication in NETGEAR products - CVE-2020-17409

Vulnerability identifier: #VU46760

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-17409

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests within the "mini_httpd" service. A remote attacker on the local network can bypass authentication process and disclose stored credentials.

R6020
R6080
R6120
R6220
R6230
R6260
R6330
R6350
R6850
WNR2020
JNR3210

Install updates from vendor's website.

R6020 - update to 1.0.0.44
R6080 - update to 1.0.0.44
R6120 - update to 1.0.0.70
R6220 - update to 1.1.0.100
R6230 - update to 1.1.0.100
R6260 - update to 1.1.0.76
R6330 - update to 1.1.0.76
R6350 - update to 1.1.0.76
R6850 - update to 1.1.0.76

• https://www.zerodayinitiative.com/advisories/ZDI-20-1176/
• https://kb.netgear.com/000062304/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2020-0258

• Improper Authentication in multiple NETGEAR Routers