VulnerabilityModified

CVE-2020-35808

Certain NETGEAR devices are affected by stored XSS.

MEDIUM 4.8EPSS 0.51%

Does this matter?

Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.

Description

Certain NETGEAR devices are affected by stored XSS. This affects D6100 before 1.0.0.63, DM200 before 1.0.0.61, R7800 before 1.0.2.52, R8900 before 1.0.4.12, R9000 before 1.0.4.12, WN3000RPv2 before 1.0.0.68, and WNR2000v5 before 1.0.0.66.

CVSS 3.1: 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.51% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: netgear/d6100 firmware · netgear/dm200 firmware · netgear/r7800 firmware · netgear/r8900 firmware · netgear/r9000 firmware · netgear/wn3000rpv2 firmware · netgear/wnr2000v5 firmware
Source: cve@mitre.org

References

https://kb.netgear.com/000062708/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Range-Extenders-PSV-2018-0158Vendor Advisory
https://kb.netgear.com/000062708/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Range-Extenders-PSV-2018-0158Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.