4.8

CVE-2020-35808

Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.63, DM200 before 1.0.0.61, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN3000RPv2 before 1.0.0.68, and WNR2000v5 before 1.0.0.66.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netgear ≫ D6100 Firmware Version < 1.0.0.63
   Netgear ≫ D6100 Version -
Netgear ≫ Dm200 Firmware Version < 1.0.0.61
   Netgear ≫ Dm200 Version -
Netgear ≫ R7800 Firmware Version < 1.0.2.52
   Netgear ≫ R7800 Version -
Netgear ≫ R8900 Firmware Version < 1.0.4.12
   Netgear ≫ R8900 Version -
Netgear ≫ R9000 Firmware Version < 1.0.4.12
   Netgear ≫ R9000 Version -
Netgear ≫ Wn3000rpv2 Firmware Version < 1.0.0.68
   Netgear ≫ Wn3000rpv2 Version -
Netgear ≫ Wnr2000v5 Firmware Version < 1.0.0.66
   Netgear ≫ Wnr2000v5 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.394
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
MITRE 4.8 1.7 2.7
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://kb.netgear.com/000062708/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Range-Extenders-PSV-2018-0158
Vendor Advisory