CVE-2019-20691 Cross-site request forgery in n/a
Attackers can perform unauthorized actions on NETGEAR routers via CSRF, requiring users to upgrade firmware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-20691?
CVE-2019-20691 is a high-severity vulnerability in Netgear D3600 Firmware, published on 16 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Certain NETGEAR devices are affected by CSRF. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, EX3700 before 1.0.0.70, EX3800 before 1.0.0.70, EX6000 before 1.0.0.30, EX6100 before 1.0.2.24, EX6120 before 1.0.0.40, EX6130 before 1.0.0.22, EX6150v1 before 1.0.0.42, EX6200 before 1.0.3.88, EX7000 before 1.0.0.66, and WN2500RPv2 before 1.0.1.54.
Weakness: CWE-352
Which versions are affected by CVE-2019-20691?
It affects 12 products.
Products include Netgear D3600 Firmware, Netgear D6000 Firmware, Netgear Ex3700 Firmware, Netgear Ex3800 Firmware, Netgear Ex6000 Firmware, Netgear Ex6100 Firmware and 6 more.
How do I fix CVE-2019-20691?
No fix has been published for CVE-2019-20691 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-20691 being exploited?
There is no known exploitation of CVE-2019-20691 in the wild and no public exploit code.
Other vulnerabilities in Netgear D3600 Firmware
Sources
Also known as GHSA-wh8w-v6q4-fgcv.