vulnwire
8.8high

CVE-2020-27872

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 rou…

Published 5 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 61%
Public exploits
0
none known

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from improper state tracking in the password recovery process. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11365.

Exploit prediction (EPSS)

0.94% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.08.8CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.18.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.08.8CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.05.8AV:A/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • NETGEAR R7450

Classification

Weakness
  • CWE-642 External Control of Critical State Data
  • CWE-668 Exposure of Resource to Wrong Sphere

References

  • zerodayinitiative.com /advisories/ZDI-21-071/ · x_refsource_MISC, x_transferred
  • kb.netgear.com /000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.