cnvd - cnvd-2020-24418

cnvd-2020-24418

Vulnerability from cnvd

Title: 多款NETGEAR产品访问控制错误漏洞

Description:

NETGEAR GS105E等都是美国网件（NETGEAR）公司的一款交换机。

多款NETGEAR产品中存在访问控制错误漏洞。目前没有详细漏洞细节提供。

Severity: 低

Patch Name: 多款NETGEAR产品访问控制错误漏洞的补丁

Patch Description:

NETGEAR GS105E等都是美国网件（NETGEAR）公司的一款交换机。

多款NETGEAR产品中存在访问控制错误漏洞。目前没有详细漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://kb.netgear.com/000061463/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Switches-PSV-2018-0542

Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-20676

Impacted products

Name
['NETGEAR GS105Ev2 <1.6.0.4', 'NETGEAR FS728TLP <1.0.1.26', 'NETGEAR GS105PE <1.6.0.4', 'NETGEAR GS108Ev3 <2.06.08', 'NETGEAR GS108PEv3 <2.06.08', 'NETGEAR GS110EMX <1.0.1.4', 'NETGEAR GS116Ev2 <2.6.0.35', 'NETGEAR GS408EPP <1.0.0.15', 'NETGEAR GS724TPv2 <1.1.1.29', 'NETGEAR GS808E <1.7.0.7', 'NETGEAR GS810EMX <1.7.1.1', 'NETGEAR GS908E <1.7.0.3', 'NETGEAR GSS108E <1.6.0.4', 'NETGEAR GSS108EPP <1.0.0.15', 'NETGEAR GSS116E <1.6.0.9', 'NETGEAR JGS516PE <2.6.0.35', 'NETGEAR JGS524Ev2 <2.6.0.35', 'NETGEAR JGS524PE <2.6.0.35', 'NETGEAR XS512EM <1.0.1.1', 'NETGEAR XS708Ev2 <1.6.0.23', 'NETGEAR XS716E <1.6.0.23', 'NETGEAR XS724EM <1.0.1.1']

Name

['NETGEAR GS105Ev2 <1.6.0.4', 'NETGEAR FS728TLP <1.0.1.26', 'NETGEAR GS105PE <1.6.0.4', 'NETGEAR GS108Ev3 <2.06.08', 'NETGEAR GS108PEv3 <2.06.08', 'NETGEAR GS110EMX <1.0.1.4', 'NETGEAR GS116Ev2 <2.6.0.35', 'NETGEAR GS408EPP <1.0.0.15', 'NETGEAR GS724TPv2 <1.1.1.29', 'NETGEAR GS808E <1.7.0.7', 'NETGEAR GS810EMX <1.7.1.1', 'NETGEAR GS908E <1.7.0.3', 'NETGEAR GSS108E <1.6.0.4', 'NETGEAR GSS108EPP <1.0.0.15', 'NETGEAR GSS116E <1.6.0.9', 'NETGEAR JGS516PE <2.6.0.35', 'NETGEAR JGS524Ev2 <2.6.0.35', 'NETGEAR JGS524PE <2.6.0.35', 'NETGEAR XS512EM <1.0.1.1', 'NETGEAR XS708Ev2 <1.6.0.23', 'NETGEAR XS716E <1.6.0.23', 'NETGEAR XS724EM <1.0.1.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-20676"
    }
  },
  "description": "NETGEAR GS105E\u7b49\u90fd\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08NETGEAR\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u4ea4\u6362\u673a\u3002\n\n\u591a\u6b3eNETGEAR\u4ea7\u54c1\u4e2d\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://kb.netgear.com/000061463/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Switches-PSV-2018-0542",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-24418",
  "openTime": "2020-04-24",
  "patchDescription": "NETGEAR GS105E\u7b49\u90fd\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08NETGEAR\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u4ea4\u6362\u673a\u3002\r\n\r\n\u591a\u6b3eNETGEAR\u4ea7\u54c1\u4e2d\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eNETGEAR\u4ea7\u54c1\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "NETGEAR GS105Ev2 \u003c1.6.0.4",
      "NETGEAR FS728TLP \u003c1.0.1.26",
      "NETGEAR GS105PE \u003c1.6.0.4",
      "NETGEAR GS108Ev3 \u003c2.06.08",
      "NETGEAR GS108PEv3 \u003c2.06.08",
      "NETGEAR GS110EMX \u003c1.0.1.4",
      "NETGEAR GS116Ev2 \u003c2.6.0.35",
      "NETGEAR GS408EPP \u003c1.0.0.15",
      "NETGEAR GS724TPv2 \u003c1.1.1.29",
      "NETGEAR GS808E \u003c1.7.0.7",
      "NETGEAR GS810EMX \u003c1.7.1.1",
      "NETGEAR GS908E \u003c1.7.0.3",
      "NETGEAR GSS108E \u003c1.6.0.4",
      "NETGEAR GSS108EPP \u003c1.0.0.15",
      "NETGEAR GSS116E \u003c1.6.0.9",
      "NETGEAR JGS516PE \u003c2.6.0.35",
      "NETGEAR JGS524Ev2 \u003c2.6.0.35",
      "NETGEAR JGS524PE \u003c2.6.0.35",
      "NETGEAR XS512EM \u003c1.0.1.1",
      "NETGEAR XS708Ev2 \u003c1.6.0.23",
      "NETGEAR XS716E \u003c1.6.0.23",
      "NETGEAR XS724EM \u003c1.0.1.1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-20676",
  "serverity": "\u4f4e",
  "submitTime": "2020-04-16",
  "title": "\u591a\u6b3eNETGEAR\u4ea7\u54c1\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e"
}

CVE-2019-20676 (GCVE-0-2019-20676)

Vulnerability from cvelistv5

Published

2020-04-15 19:14

Modified

2024-08-05 02:46

Severity ?

6.0 (Medium) - CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CWE

Summary

Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS724TPv2 before 1.1.1.29, GS808E before 1.7.0.7, GS810EMX before 1.7.1.1, GS908E before 1.7.0.3, GSS108E before 1.6.0.4, GSS108EPP before 1.0.0.15, GSS116E before 1.6.0.9, JGS516PE before 2.6.0.35, JGS524Ev2 before 2.6.0.35, JGS524PE before 2.6.0.35, XS512EM before 1.0.1.1, XS708Ev2 before 1.6.0.23, XS716E before 1.6.0.23, and XS724EM before 1.0.1.1.

References

▼	URL	Tags
	https://kb.netgear.com/000061463/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Switches-PSV-2018-0542	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:46:10.323Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kb.netgear.com/000061463/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Switches-PSV-2018-0542"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS724TPv2 before 1.1.1.29, GS808E before 1.7.0.7, GS810EMX before 1.7.1.1, GS908E before 1.7.0.3, GSS108E before 1.6.0.4, GSS108EPP before 1.0.0.15, GSS116E before 1.6.0.9, JGS516PE before 2.6.0.35, JGS524Ev2 before 2.6.0.35, JGS524PE before 2.6.0.35, XS512EM before 1.0.1.1, XS708Ev2 before 1.6.0.23, XS716E before 1.6.0.23, and XS724EM before 1.0.1.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AC:L/AV:L/A:N/C:H/I:H/PR:H/S:U/UI:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-15T19:14:05",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kb.netgear.com/000061463/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Switches-PSV-2018-0542"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-20676",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS724TPv2 before 1.1.1.29, GS808E before 1.7.0.7, GS810EMX before 1.7.1.1, GS908E before 1.7.0.3, GSS108E before 1.6.0.4, GSS108EPP before 1.0.0.15, GSS116E before 1.6.0.9, JGS516PE before 2.6.0.35, JGS524Ev2 before 2.6.0.35, JGS524PE before 2.6.0.35, XS512EM before 1.0.1.1, XS708Ev2 before 1.6.0.23, XS716E before 1.6.0.23, and XS724EM before 1.0.1.1."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AC:L/AV:L/A:N/C:H/I:H/PR:H/S:U/UI:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://kb.netgear.com/000061463/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Switches-PSV-2018-0542",
              "refsource": "CONFIRM",
              "url": "https://kb.netgear.com/000061463/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Switches-PSV-2018-0542"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-20676",
    "datePublished": "2020-04-15T19:14:05",
    "dateReserved": "2020-04-15T00:00:00",
    "dateUpdated": "2024-08-05T02:46:10.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted