{"api_version":"1","generated_at":"2026-07-23T11:50:28+00:00","cve":"CVE-2020-5641","urls":{"html":"https://cve.report/CVE-2020-5641","api":"https://cve.report/api/cve/CVE-2020-5641.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-5641","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-5641"},"summary":{"title":"CVE-2020-5641","description":"Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention or consent via unspecified vectors.","state":"PUBLIC","assigner":"vultures@jpcert.or.jp","published_at":"2020-11-24 07:15:00","updated_at":"2020-12-03 14:18:00"},"problem_types":["CWE-352"],"metrics":[],"references":[{"url":"https://kb.netgear.com/000062496/GS108Ev3-Firmware-Version-2-06-14","name":"https://kb.netgear.com/000062496/GS108Ev3-Firmware-Version-2-06-14","refsource":"MISC","tags":["Vendor Advisory"],"title":"GS108Ev3 Firmware Version 2.06.14 | Answer | NETGEAR Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://jvn.jp/en/jp/JVN27806339/index.html","name":"https://jvn.jp/en/jp/JVN27806339/index.html","refsource":"MISC","tags":["Third Party Advisory"],"title":"JVN#27806339: NETGEAR GS108Ev3 vulnerable to cross-site request forgery","mime":"text/xml","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-5641","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5641","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"5641","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"netgear","cpe5":"gs108ev3","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"5641","vulnerable":"0","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"netgear","cpe5":"gs108ev3","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"5641","vulnerable":"1","versionEndIncluding":"2.06.10","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"netgear","cpe5":"gs108ev3_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2020-5641","ASSIGNER":"vultures@jpcert.or.jp","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Netgear Japan G.K.","product":{"product_data":[{"product_name":"GS108Ev3","version":{"version_data":[{"version_value":"Firmware version 2.06.10 and earlier"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-site request forgery"}]}]},"references":{"reference_data":[{"url":"https://kb.netgear.com/000062496/GS108Ev3-Firmware-Version-2-06-14","refsource":"MISC","name":"https://kb.netgear.com/000062496/GS108Ev3-Firmware-Version-2-06-14"},{"url":"https://jvn.jp/en/jp/JVN27806339/index.html","refsource":"MISC","name":"https://jvn.jp/en/jp/JVN27806339/index.html"}]},"description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention or consent via unspecified vectors."}]}},"nvd":{"publishedDate":"2020-11-24 07:15:00","lastModifiedDate":"2020-12-03 14:18:00","problem_types":["CWE-352"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:netgear:gs108ev3_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"2.06.10","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:h:netgear:gs108ev3:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"5641","Ordinal":"165887","Title":"CVE-2020-5641","CVE":"CVE-2020-5641","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"5641","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention or consent via unspecified vectors.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"5641","Ordinal":"2","NoteData":"2020-11-24","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"5641","Ordinal":"3","NoteData":"2020-11-24","Type":"Other","Title":"Modified"}]}}}