CVE & CISA-KEV Catalog

CVE-2019-20676

MEDIUM
6.0
CVSS v3
NVD

Description

Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08, GS108PEv3 before 2.06.08, GS110EMX before 1.0.1.4, GS116Ev2 before 2.6.0.35, GS408EPP before 1.0.0.15, GS724TPv2 before 1.1.1.29, GS808E before 1.7.0.7, GS810EMX before 1.7.1.1, GS908E before 1.7.0.3, GSS108E before 1.6.0.4, GSS108EPP before 1.0.0.15, GSS116E before 1.6.0.9, JGS516PE before 2.6.0.35, JGS524Ev2 before 2.6.0.35, JGS524PE before 2.6.0.35, XS512EM before 1.0.1.1, XS708Ev2 before 1.6.0.23, XS716E before 1.6.0.23, and XS724EM before 1.0.1.1.

CWE-862Missing Authorization

How to fix

Remediation Available
fs728tlp firmwareNVD
Affected:< 1.0.1.26Fixed in:1.0.1.26CVE-2019-20676derived from NVD
gs105e firmwareNVD
Affected:< 1.6.0.4Fixed in:1.6.0.4CVE-2019-20676derived from NVD
gs105pe firmwareNVD
Affected:< 1.6.0.4Fixed in:1.6.0.4CVE-2019-20676derived from NVD
gs108e firmwareNVD
Affected:< 2.06.08Fixed in:2.06.08CVE-2019-20676derived from NVD
gs108pe firmwareNVD
Affected:< 2.06.08Fixed in:2.06.08CVE-2019-20676derived from NVD
gs110emx firmwareNVD
Affected:< 1.0.1.4Fixed in:1.0.1.4CVE-2019-20676derived from NVD
gs116e firmwareNVD
Affected:< 2.6.0.35Fixed in:2.6.0.35CVE-2019-20676derived from NVD
gs408epp firmwareNVD
Affected:< 1.0.0.15Fixed in:1.0.0.15CVE-2019-20676derived from NVD
gs724tp firmwareNVD
Affected:< 1.1.1.29Fixed in:1.1.1.29CVE-2019-20676derived from NVD
gs808e firmwareNVD
Affected:< 1.7.0.7Fixed in:1.7.0.7CVE-2019-20676derived from NVD
gs810emx firmwareNVD
Affected:< 1.7.1.1Fixed in:1.7.1.1CVE-2019-20676derived from NVD
gs908e firmwareNVD
Affected:< 1.7.0.3Fixed in:1.7.0.3CVE-2019-20676derived from NVD
gss108e firmwareNVD
Affected:< 1.6.0.4Fixed in:1.6.0.4CVE-2019-20676derived from NVD
gss108epp firmwareNVD
Affected:< 1.0.0.15Fixed in:1.0.0.15CVE-2019-20676derived from NVD
gss116e firmwareNVD
Affected:< 1.6.0.9Fixed in:1.6.0.9CVE-2019-20676derived from NVD
jgs516pe firmwareNVD
Affected:< 2.6.0.35Fixed in:2.6.0.35CVE-2019-20676derived from NVD
jgs524e firmwareNVD
Affected:< 2.6.0.35Fixed in:2.6.0.35CVE-2019-20676derived from NVD
jgs524pe firmwareNVD
Affected:< 2.6.0.35Fixed in:2.6.0.35CVE-2019-20676derived from NVD
xs512em firmwareNVD
Affected:< 1.0.1.1Fixed in:1.0.1.1CVE-2019-20676derived from NVD
xs708e firmwareNVD
Affected:< 1.6.0.23Fixed in:1.6.0.23CVE-2019-20676derived from NVD
xs716e firmwareNVD
Affected:< 1.6.0.23Fixed in:1.6.0.23CVE-2019-20676derived from NVD
xs724em firmwareNVD
Affected:< 1.0.1.1Fixed in:1.0.1.1CVE-2019-20676derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal
Attack ComplexityLow
Privileges RequiredHigh
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Exploit Intelligence

0.30%probability of exploitation in 30 days
22ndpercentile

Low risk: more likely to be exploited than 22% of all known CVEs.

References

Vendor Advisory1

Related Vulnerabilities

Other CWE-862 (Missing Authorization) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2021-39226Critical9.8100%KEVFix
CVE-2022-0543Critical10.0100%KEVFix
CVE-2021-21978Critical9.899%-Fix
CVE-2023-52163High8.896%KEV-
CVE-2022-1329High8.893%--
CVE-2023-6875Critical9.890%--
Embed a live status badge for CVE-2019-20676
CVE-2019-20676 severity badge

Markdown

[![CVE-2019-20676](https://tridentstack.com/cve/badge/CVE-2019-20676.svg)](https://tridentstack.com/cve/CVE-2019-20676)

HTML

<a href="https://tridentstack.com/cve/CVE-2019-20676"><img src="https://tridentstack.com/cve/badge/CVE-2019-20676.svg" alt="CVE-2019-20676"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.