CVE-2020-13245 : Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This

Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P.

Published 2020-05-28 19:15:11

Updated 2020-05-29 19:05:18

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-13245

Netgear » R6400 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r6400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6400 » Version: N/A
Netgear » R8000 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r8000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R8000 » Version: N/A
Netgear » R6220 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6220 » Version: N/A
Netgear » R6120 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r6120_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6120 » Version: N/A
Netgear » R6800 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r6800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6800 » Version: N/A
Netgear » R7000p Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r7000p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7000p » Version: N/A
Netgear » R7800 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r7800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7800 » Version: N/A
Netgear » R9000 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R9000 » Version: N/A
Netgear » Xr500 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Xr500 » Version: N/A
Netgear » Rbr20 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:rbr20_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr20 » Version: N/A
Netgear » Rax120 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:rax120_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rax120 » Version: N/A
Netgear » Xr300 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:xr300_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Xr300 » Version: N/A
Netgear » R6850 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r6850_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6850 » Version: N/A
Netgear » R6350 Firmware
Versions from including (>=) v1.0.9.6_1.2.19 and up to, including, (<=) v1.0.11.100_10.2.100
cpe:2.3:o:netgear:r6350_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6350 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-13245

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-13245

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2020-13245

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-13245

https://iot-lab-fh-ooe.github.io/netgear_update_vulnerability/

Netgear Nighthawk Firmware Update Vulnerability
Exploit;Third Party Advisory
https://www.netgear.com/about/security/

Security Advisory | About Us | NETGEAR
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-13245

Products affected by CVE-2020-13245

Exploit prediction scoring system (EPSS) score for CVE-2020-13245

CVSS scores for CVE-2020-13245

CWE ids for CVE-2020-13245

References for CVE-2020-13245