Vulnerability Details : CVE-2020-35801
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. A TFTP server was found to be active by default. It allows remote authenticated users to update the switch firmware.
Products affected by CVE-2020-35801
- cpe:2.3:o:netgear:jgs516pe_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:jgs524e_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:jgs524pe_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs116e_firmware:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-35801
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 26 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-35801
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:P |
8.0
|
4.9
|
NIST | |
|
8.3
|
HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H |
2.8
|
5.5
|
MITRE | |
|
7.3
|
HIGH | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
2.1
|
5.2
|
NIST |
References for CVE-2020-35801
-
https://kb.netgear.com/000062635/Security-Advisory-for-Security-Misconfiguration-on-Some-Smart-Managed-Plus-Switches-PSV-2020-0376
Security Advisory for Security Misconfiguration on Some Smart Managed Plus Switches, PSV-2020-0376 | Answer | NETGEAR SupportVendor Advisory
-
https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
Technical Advisory – Multiple Vulnerabilities in Netgear ProSAFE Plus JGS516PE / GS116Ev2 Switches – NCC Group ResearchNot Applicable
Jump to