CVE-2020-10930

6.5MEDIUM

Key Information:

Vendor: Netgear
Status: R6700
Vendor: CVE Published:; 28 July 2020

Summary

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from the lack of proper routing of URLs. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-9618.

Affected Version(s)

R6700 V1.0.4.84_10.0.58

References

https://www.zerodayinitiative.com/advisories/ZDI-20-711/

x_refsource_MISC

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Adjacent Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jul 28, 2020
Vulnerability Reserved
Mar 24, 2020

Credit

d4rkn3ss from VNPT ISC