CVE-2020-17409
Summary
| CVE | CVE-2020-17409 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-10-13 17:15:00 UTC |
| Updated | 2020-12-03 15:46:00 UTC |
| Description | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020, JNR3210, and WNR2020 routers with firmware 1.0.66. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10754. |
Risk And Classification
Problem Types: CWE-288
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Netgear | Jnr3210 | - | All | All | All |
| Hardware | Netgear | Jnr3210 | - | All | All | All |
| Operating System | Netgear | Jnr3210 Firmware | - | All | All | All |
| Operating System | Netgear | Jnr3210 Firmware | - | All | All | All |
| Hardware | Netgear | R6020 | - | All | All | All |
| Hardware | Netgear | R6020 | - | All | All | All |
| Operating System | Netgear | R6020 Firmware | All | All | All | All |
| Operating System | Netgear | R6020 Firmware | All | All | All | All |
| Hardware | Netgear | R6080 | - | All | All | All |
| Hardware | Netgear | R6080 | - | All | All | All |
| Operating System | Netgear | R6080 Firmware | All | All | All | All |
| Operating System | Netgear | R6080 Firmware | All | All | All | All |
| Hardware | Netgear | R6120 | - | All | All | All |
| Hardware | Netgear | R6120 | - | All | All | All |
| Operating System | Netgear | R6120 Firmware | All | All | All | All |
| Operating System | Netgear | R6120 Firmware | All | All | All | All |
| Hardware | Netgear | R6220 | - | All | All | All |
| Hardware | Netgear | R6220 | - | All | All | All |
| Operating System | Netgear | R6220 Firmware | All | All | All | All |
| Operating System | Netgear | R6220 Firmware | All | All | All | All |
| Hardware | Netgear | R6230 | - | All | All | All |
| Hardware | Netgear | R6230 | - | All | All | All |
| Operating System | Netgear | R6230 Firmware | All | All | All | All |
| Operating System | Netgear | R6230 Firmware | All | All | All | All |
| Hardware | Netgear | R6260 | - | All | All | All |
| Hardware | Netgear | R6260 | - | All | All | All |
| Operating System | Netgear | R6260 Firmware | All | All | All | All |
| Operating System | Netgear | R6260 Firmware | All | All | All | All |
| Hardware | Netgear | R6330 | - | All | All | All |
| Hardware | Netgear | R6330 | - | All | All | All |
| Operating System | Netgear | R6330 Firmware | All | All | All | All |
| Operating System | Netgear | R6330 Firmware | All | All | All | All |
| Hardware | Netgear | R6350 | - | All | All | All |
| Hardware | Netgear | R6350 | - | All | All | All |
| Operating System | Netgear | R6350 Firmware | All | All | All | All |
| Operating System | Netgear | R6350 Firmware | All | All | All | All |
| Hardware | Netgear | R6850 | - | All | All | All |
| Hardware | Netgear | R6850 | - | All | All | All |
| Operating System | Netgear | R6850 Firmware | All | All | All | All |
| Operating System | Netgear | R6850 Firmware | All | All | All | All |
| Hardware | Netgear | Wnr2020 | - | All | All | All |
| Hardware | Netgear | Wnr2020 | - | All | All | All |
| Operating System | Netgear | Wnr2020 Firmware | - | All | All | All |
| Operating System | Netgear | Wnr2020 Firmware | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Advisory for Authentication Bypass on Some Routers, PSV-2020-0258 | Answer | NETGEAR Support | N/A | kb.netgear.com | Patch, Vendor Advisory |
| ZDI-20-1176 | Zero Day Initiative | N/A | www.zerodayinitiative.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.