CVE-2020-26919criticalunder attack

CVE-2020-26919

Published · Updated

85Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 57%
from disclosure to weapon
Published on NVDOct 9
CISA KEV+390d
exploitation probability
57%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

NETGEAR JGS516PE switches before version 2.6.0.43 lack proper access controls, allowing unauthorized users to perform administrative functions they shouldn't be able to access. This means attackers could gain control over the device's critical settings without proper authentication.

Technical detail

The vulnerability stems from insufficient function-level access control in NETGEAR JGS516PE versions prior to 2.6.0.43, enabling unauthenticated or low-privileged users to invoke administrative operations. An attacker with network access can directly call protected functions without proper authorization checks, leading to complete device compromise and potential network disruption.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
Affected products
n/a · n/a
References
https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-26919