Stored Cross-Site Scripting Vulnerability in NETGEAR Devices
CVE-2020-35842

6.9MEDIUM

Key Information:

Vendor
Netgear
Status
D6200 Firmware
Vendor
CVE Published:
30 December 2020

Summary

Certain NETGEAR router models are susceptible to stored cross-site scripting (XSS) attacks, allowing attackers to inject malicious scripts into the web interface. This vulnerability impacts various device models, including the D6200, D7000, and others, prior to their respective firmware updates. If exploited, this flaw could enable malicious actors to execute harmful scripts in the context of the user's session or steal sensitive information. Users are advised to update their devices to mitigate potential security risks.

References

https://kb.netgear.com/000062713/Security-Advisory-for-St...
x_refsource_MISC

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.