CVE-2020-26923

Certain NETGEAR devices are affected by stored XSS. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5.24, and WC9500 before 6.5.5.24.

CVSS v3 4.3 MEDIUM
CVSS v2.0 3.5 LOW

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 2.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://kb.netgear.com/000062329/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Wireless-Controllers-PSV-2020-0180	Vendor Advisory
https://kb.netgear.com/000062329/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Wireless-Controllers-PSV-2020-0180	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netgear:wc7500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:wc7500:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:netgear:wc7600_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:wc7600:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:netgear:wc7600v2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:wc7600v2:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:netgear:wc9500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:wc9500:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:20

Type	Values Removed	Values Added
References	~~() https://kb.netgear.com/000062329/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Wireless-Controllers-PSV-2020-0180 - Vendor Advisory~~	() https://kb.netgear.com/000062329/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Wireless-Controllers-PSV-2020-0180 - Vendor Advisory
CVSS	v2 : ~~3.5~~ v3 : ~~4.8~~	v2 : 3.5 v3 : 4.3

Information

Published : 2020-10-09 07:15

Updated : 2024-11-21 05:20

NVD link : CVE-2020-26923

Mitre link : CVE-2020-26923

CVE.ORG link : CVE-2020-26923

JSON object : View

Products Affected

netgear

wc7600v2_firmware
wc7600_firmware
wc9500
wc7600
wc7500
wc9500_firmware
wc7500_firmware
wc7600v2

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2020-26923", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2020-10-09T07:15:17.950", "references": [{"url": "https://kb.netgear.com/000062329/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Wireless-Controllers-PSV-2020-0180", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://kb.netgear.com/000062329/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Wireless-Controllers-PSV-2020-0180", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Certain NETGEAR devices are affected by stored XSS. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5.24, and WC9500 before 6.5.5.24."}, {"lang": "es", "value": "Determinados dispositivos NETGEAR, est\u00e1n afectados por una vulnerabilidad de tipo XSS almacenado. Esto afecta a WC7500 versiones anteriores a 6.5.5.24, WC7600 versiones anteriores a 6.5.5.24, WC7600v2 versiones anteriores a 6.5.5.24 y WC9500 versiones anteriores a 6.5.5.24"}], "lastModified": "2024-11-21T05:20:30.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:wc7500_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C7EBAEB-4D71-4F10-8B42-F5C844E1B71E", "versionEndExcluding": "6.5.5.24"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:wc7500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EB22B065-8EC8-4DA7-984A-CCB6919AF8F3"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:wc7600_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93AD60DB-0EBB-467B-AD0C-5C107DCC446F", "versionEndExcluding": "6.5.5.24"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:wc7600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FF16A53E-FFFD-4F11-831A-82BB76675CBD"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:wc7600v2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "470918A5-9FE0-4F63-8455-5527CF138F54", "versionEndExcluding": "6.5.5.24"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:wc7600v2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4C8BB1F1-A12D-43CC-A6D0-9633E99D746B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:wc9500_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23E6496E-07CD-4191-B117-530D063514EE", "versionEndExcluding": "6.5.5.24"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:wc9500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "113D0DF6-C719-4A43-80B2-463EC4323009"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}