Improper Authentication in NETGEAR products - CVE-2020-27872

Vulnerability identifier: #VU49683

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-27872

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper state tracking in the password recovery process within the "mini_httpd" service. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.

R6080
R6020
R6120
R6850
R6350
R6330
R6260
R6230
R6220
R7450
AC2100
R7400
R7350
R7200
R6900v2
R6800
R6700v2
AC2600
AC2400

Install updates from vendor's website.

R6080 - update to 1.0.0.48
R6020 - update to 1.0.0.48
R6120 - update to 1.0.0.76
R6850 - update to 1.1.0.78
R6350 - update to 1.1.0.78
R6330 - update to 1.1.0.78
R6260 - update to 1.1.0.78
R6230 - update to 1.1.0.104
R6220 - update to 1.1.0.104
R7450 - update to 1.2.0.76
AC2100 - update to 1.2.0.76
R7400 - update to 1.2.0.76
R7350 - update to 1.2.0.76
R7200 - update to 1.2.0.76
R6900v2 - update to 1.2.0.76
R6800 - update to 1.2.0.76
R6700v2 - update to 1.2.0.76
AC2600 - update to 1.2.0.76
AC2400 - update to 1.2.0.76

• https://www.zerodayinitiative.com/advisories/ZDI-21-071/
• https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers

• Multiple vulnerabilities in NETGEAR Routers