CVE-2019-20715

EUVD-2019-11254 · Published Apr 16, 2020

Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6100 before 1.0.0.63, D7800 before 1.0.1.47, DM200 before 1.0.0.61, R7500v2 before 1.0.3.40, R7800 before 1.0.2.60, RBK50 before 2.3.0.32, RBR50 before 2.3.0.32, and RBS50 before 2.3.0.32.

Technologies

Netgear R7800Netgear D3600Netgear R7500 FirmwareNetgear D6100Netgear Rbs50 FirmwareNetgear D6000Netgear Rbk50 FirmwareNetgear R7800 FirmwareNetgear Dm200Netgear Rbr50Netgear Rbr50 FirmwareNetgear D7800Netgear D6000 FirmwareNetgear D6100 FirmwareNetgear Dm200 FirmwareNetgear Rbk50Netgear Rbs50Netgear D7800 FirmwareNetgear D3600 FirmwareNetgear R7500

Weaknesses

CWE-79

CVSS scores

v3.14.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
v2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://kb.netgear.com/000061213/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2018-0248

Potentially impacted assets

See if this affects your attack surface