CVE-2020-26908

Certain NETGEAR devices are affected by authentication bypass

Critical · published October 9, 2020

CVSS v3.1
9.4
EPSS
2%
Percentile
81.2
In the wild
Unconfirmed
What it is

🚨 An authentication bypass bug is lurking in multiple NETGEAR devices! This flaw allows unauthorized access to your network like a delivery person entering your house without checking their ID. 🔥 Think of it as a hotel where the front desk is supposed to verify guests’ identities before handing out room keys, but the receptionist just nods and hands them out freely. With this vulnerability, anyone can walk in without proper credentials! This could lead to a malicious actor gaining full access to your network, allowing them to change settings, monitor traffic, or even hijack connected devices. The potential for data theft and unauthorized control makes this risk absolutely devastating!

Put simply

Think of it as a hotel where the front desk is supposed to verify guests’ identities before handing out room keys, but the receptionist just nods and hands them out freely. With this vulnerability, anyone can walk in without proper credentials! The vulnerability allows attackers to bypass authentication checks on NETGEAR devices, affecting a range of models and versions. By exploiting this flaw, they can gain access to configuration settings as if they were legitimate users.

What to do

This could lead to a malicious actor gaining full access to your network, allowing them to change settings, monitor traffic, or even hijack connected devices. The potential for data theft and unauthorized control makes this risk absolutely devastating! Immediate action is crucial! Update your NETGEAR device firmware to the latest versions: D6200 to 1.1.00.36, D7000 to 1.0.1.74, and so forth for all affected models. Check NETGEAR's website for the most current updates. 🛡️ You've got this! By patching these vulnerabilities, you'll bolster your network security in no time. 🚀

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.02061 · 81.2th percentile
Published
2020-10-09T06:31Z
EPSS history
Timeline
  • 09 OCT 06:31Z
    Certain NETGEAR devices are affected by authentication bypass
    cvelistv5