CVE-2020-26919KEV · OVERDUE

Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability

Critical · published October 9, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.1th percentile for exploit probability.

1636
days past CISA
deadline
CVSS v3.1
9.8
EPSS
57%
Percentile
99.1
In the wild
Confirmed
What it is

🚨 A critical access control flaw exists in NETGEAR JGS516PE devices, letting anyone waltz in and take over functions as if they owned the place! 🔥 Think of it like a fancy restaurant where anyone can stroll into the kitchen and cook whatever they want, bypassing all the safety checks. When access isn't controlled properly, the consequences could be chaotic! An attacker could exploit this vulnerability to gain unauthorized access, potentially altering settings, disrupting services, or even compromising the entire network. With a CVSS score of 9.8, this is absolutely devastating and demands immediate attention!

Put simply

Think of it like a fancy restaurant where anyone can stroll into the kitchen and cook whatever they want, bypassing all the safety checks. When access isn't controlled properly, the consequences could be chaotic! This vulnerability arises from a lack of proper access control at the function level in NETGEAR JGS516PE devices, allowing unauthorized commands to be executed without proper authentication checks.

What to do

An attacker could exploit this vulnerability to gain unauthorized access, potentially altering settings, disrupting services, or even compromising the entire network. With a CVSS score of 9.8, this is absolutely devastating and demands immediate attention! To mitigate this issue, upgrade your NETGEAR JGS516PE devices to version 2.6.0.43 or later as soon as possible. Regularly audit your network configurations to ensure that proper access controls are in place and monitor for any suspicious activity. 🔒 You've got this! Follow these steps, and you'll bolster your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.57468 · 99.1th percentile
Published
2020-10-09T06:29Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 09 OCT 06:29Z
    NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level
    cvelistv5