9.3

CVE-2020-35798

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R6900P before 1.3.2.124, R7000 before 1.0.11.100, R7000P before 1.3.2.124, R7800 before 1.0.2.74, R7850 before 1.0.5.60, R7900 before 1.0.4.26, R7960P before 1.4.1.50, R8000 before 1.0.4.52, R7900P before 1.4.1.50, R8000P before 1.4.1.50, RAX15 before 1.0.1.64, RAX20 before 1.0.1.64, RAX200 before 1.0.1.12, RAX45 before 1.0.2.66, RAX50 before 1.0.2.66, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, RBS850 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RS400 before 1.5.0.48, and XR300 before 1.0.3.50.

Data is provided by the National Vulnerability Database (NVD)
NetgearR6400v2 Firmware Version < 1.0.4.84
   NetgearR6400v2 Version-
NetgearR6700v3 Firmware Version < 1.0.4.84
   NetgearR6700v3 Version-
NetgearR6900p Firmware Version < 1.3.2.124
   NetgearR6900p Version-
NetgearR7000 Firmware Version < 1.0.11.100
   NetgearR7000 Version-
NetgearR7000p Firmware Version < 1.3.2.124
   NetgearR7000p Version-
NetgearR7800 Firmware Version < 1.0.2.74
   NetgearR7800 Version-
NetgearR7850 Firmware Version < 1.0.5.60
   NetgearR7850 Version-
NetgearR7900 Firmware Version < 1.0.4.26
   NetgearR7900 Version-
NetgearR7960p Firmware Version < 1.4.1.50
   NetgearR7960p Version-
NetgearR8000 Firmware Version < 1.0.4.52
   NetgearR8000 Version-
NetgearR7900p Firmware Version < 1.4.1.50
   NetgearR7900p Version-
NetgearR8000p Firmware Version < 1.4.1.50
   NetgearR8000p Version-
NetgearRax15 Firmware Version < 1.0.1.64
   NetgearRax15 Version-
NetgearRax20 Firmware Version < 1.0.1.64
   NetgearRax20 Version-
NetgearRax200 Firmware Version < 1.0.1.12
   NetgearRax200 Version-
NetgearRax45 Firmware Version < 1.0.2.66
   NetgearRax45 Version-
NetgearRax50 Firmware Version < 1.0.2.66
   NetgearRax50 Version-
NetgearRax75 Firmware Version < 1.0.3.102
   NetgearRax75 Version-
NetgearRax80 Firmware Version < 1.0.3.102
   NetgearRax80 Version-
NetgearRbk752 Firmware Version < 3.2.16.6
   NetgearRbk752 Version-
NetgearRbr750 Firmware Version < 3.2.16.6
   NetgearRbr750 Version-
NetgearRbs750 Firmware Version < 3.2.16.6
   NetgearRbs750 Version-
NetgearRbk852 Firmware Version < 3.2.15.25
   NetgearRbk852 Version-
NetgearRbr850 Firmware Version < 3.2.15.25
   NetgearRbr850 Version-
NetgearRbs850 Firmware Version < 3.2.15.25
   NetgearRbs850 Version-
NetgearRbk842 Firmware Version < 3.2.15.25
   NetgearRbk842 Version-
NetgearRbr840 Firmware Version < 3.2.15.25
   NetgearRbr840 Version-
NetgearRbs840 Firmware Version < 3.2.15.25
   NetgearRbs840 Version-
NetgearRs400 Firmware Version < 1.5.0.48
   NetgearRs400 Version-
NetgearXr300 Firmware Version < 1.0.3.50
   NetgearXr300 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.38% 0.562
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
cve@mitre.org 9.3 2.5 6
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.