Lucene search

MitreCVE-2020-35227

HistoryMar 10, 2021 - 7:15 p.m.

CVE-2020-35227

2021-03-1019:15:12

CWE-120

mitre

web.nvd.nist.gov

buffer overflow

vulnerability

access control

netgear

jgs516pe

gs116ev2

nvd

cve-2020-35227

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

34.5%

JSON

A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices (in the administration web panel) allows an attacker to inject IP addresses into the whitelist via the checkedList parameter to the delete command.

Affected configurations

Nvd

Node

netgeargs116e_firmwareMatch2.6.0.43

AND

netgeargs116eMatchv2

Node

netgearjgs516pe_firmwareMatch2.6.0.43

AND

netgearjgs516peMatch-

VendorProductVersionCPE
netgeargs116e_firmware2.6.0.43cpe:2.3:o:netgear:gs116e_firmware:2.6.0.43:*:*:*:*:*:*:*
netgeargs116ev2cpe:2.3:h:netgear:gs116e:v2:*:*:*:*:*:*:*
netgearjgs516pe_firmware2.6.0.43cpe:2.3:o:netgear:jgs516pe_firmware:2.6.0.43:*:*:*:*:*:*:*
netgearjgs516pe-cpe:2.3:h:netgear:jgs516pe:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netgear	gs116e_firmware	2.6.0.43	cpe:2.3:o:netgear:gs116e_firmware:2.6.0.43:::::::*
netgear	gs116e	v2	cpe:2.3:h:netgear:gs116e:v2:::::::*
netgear	jgs516pe_firmware	2.6.0.43	cpe:2.3:o:netgear:jgs516pe_firmware:2.6.0.43:::::::*
netgear	jgs516pe	-	cpe:2.3:h:netgear:jgs516pe:-:::::::*

References

research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

34.5%

JSON

Related for CVE-2020-35227