CVE-2019-20699

Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker

High · published April 16, 2020

CVSS v3.0
7.5
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

🚨 A buffer overflow bug in certain NETGEAR devices lets attackers step right in without a password! Think of it like a delivery driver who’s allowed to enter a secure storage room because the door wasn't properly locked — they can reach anything inside without any checks. 🏢 An unauthenticated attacker could exploit this vulnerability to execute arbitrary code on the affected devices, potentially gaining complete control. Imagine a thief casually running off with the keys to your network — absolutely devastating for your security! 🔥

Put simply

Think of it like a delivery driver who’s allowed to enter a secure storage room because the door wasn't properly locked — they can reach anything inside without any checks. 🏢 This buffer overflow occurs when the device fails to properly validate the incoming data, allowing an attacker to send more data than the buffer can handle, resulting in unexpected behavior or code execution.

What to do

An unauthenticated attacker could exploit this vulnerability to execute arbitrary code on the affected devices, potentially gaining complete control. Imagine a thief casually running off with the keys to your network — absolutely devastating for your security! 🔥 To protect your network, update your NETGEAR devices to the latest firmware: GS105Ev2 to version 1.6.0.4 or later, GS105PE to 1.6.0.4 or later, and so on for all affected models. Don’t delay; patching is crucial! 🚀 You've got this! Follow these steps and you’ll have your network bolstered against threats in no time. 🛡️

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01139 · 66.3th percentile
Published
2020-04-16T14:35Z
EPSS history
Timeline
  • 16 APR 14:35Z
    Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker
    cvelistv5