CVE-2020-26908 : Certain NETGEAR devices are affected by authentication bypass. This affects D620

Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.36, D7000 before 1.0.1.74, PR2000 before 1.0.0.30, R6020 before 1.0.0.42, R6050 before 1.0.1.22, JR6150 before 1.0.1.22, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R69002 before 1.2.0.62, and WNR2020 before 1.1.0.62.

Published 2020-10-09 07:15:17

Updated 2020-10-16 18:38:32

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-26908

Netgear » R6900 Firmware
Versions before (<) 1.2.0.62
cpe:2.3:o:netgear:r6900_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6900 » Version: N/A
Netgear » D6200 Firmware
Versions before (<) 1.1.00.36
cpe:2.3:o:netgear:d6200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » D6200 » Version: N/A
Netgear » Jr6150 Firmware
Versions before (<) 1.0.1.22
cpe:2.3:o:netgear:jr6150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Jr6150 » Version: N/A
Netgear » R6050 Firmware
Versions before (<) 1.0.1.22
cpe:2.3:o:netgear:r6050_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6050 » Version: N/A
Netgear » R6220 Firmware
Versions before (<) 1.1.0.100
cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6220 » Version: N/A
Netgear » Wnr2020 Firmware
Versions before (<) 1.1.0.62
cpe:2.3:o:netgear:wnr2020_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wnr2020 » Version: N/A
Netgear » D7000 Firmware
Versions before (<) 1.0.1.74
cpe:2.3:o:netgear:d7000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » D7000 » Version: N/A
Netgear » Pr2000 Firmware
Versions before (<) 1.0.0.30
cpe:2.3:o:netgear:pr2000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Pr2000 » Version: N/A
Netgear » R6020 Firmware
Versions before (<) 1.0.0.42
cpe:2.3:o:netgear:r6020_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6020 » Version: N/A
Netgear » R6080 Firmware
Versions before (<) 1.0.0.42
cpe:2.3:o:netgear:r6080_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6080 » Version: N/A
Netgear » R6120 Firmware
Versions before (<) 1.0.0.66
cpe:2.3:o:netgear:r6120_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6120 » Version: N/A
Netgear » R6800 Firmware
Versions before (<) 1.2.0.62
cpe:2.3:o:netgear:r6800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6800 » Version: N/A
Netgear » R6230 Firmware
Versions before (<) 1.1.0.100
cpe:2.3:o:netgear:r6230_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6230 » Version: N/A
Netgear » R6260 Firmware
Versions before (<) 1.1.0.64
cpe:2.3:o:netgear:r6260_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6260 » Version: N/A
Netgear » R6700v2 Firmware
Versions before (<) 1.2.0.62
cpe:2.3:o:netgear:r6700v2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6700v2 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-26908

EPSS FAQ

0.31%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 66 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-26908

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.4	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	3.9	5.5	MITRE
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: Low
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2020-26908

https://kb.netgear.com/000062346/Security-Advisory-for-Authentication-Bypass-Some-Modems-and-Routers-PSV-2019-0001

Security Advisory for Authentication Bypass Some Modems and Routers, PSV-2019-0001 | Answer | NETGEAR Support
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-26908

Products affected by CVE-2020-26908

Exploit prediction scoring system (EPSS) score for CVE-2020-26908

CVSS scores for CVE-2020-26908

References for CVE-2020-26908