CVE-2019-20756 Cross-site scripting in n/a

High 7.1 Published 16 Apr 2020 Updated 5 Aug 2024

Reflected XSS in NETGEAR routers allows attackers to execute scripts in user browsers, potentially leading to session hijacking or data theft.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-20756?

CVE-2019-20756 is a high-severity cross-site scripting vulnerability in Netgear Ex6200 Firmware, published on 16 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Certain NETGEAR devices are affected by reflected XSS. This affects EX7000 before 1.0.0.64, EX6200 before 1.0.3.86, EX6150 before 1.0.0.38, EX6130 before 1.0.0.22, EX6120 before 1.0.0.40, EX6100 before 1.0.2.22, EX6000 before 1.0.0.30, EX3700 before 1.0.0.70, EX3800 before 1.0.0.70, R8300 before 1.0.2.94, R7300DST before 1.0.0.62, R7000P before 1.3.0.20, R6900P before 1.3.0.20, R6400 before 1.0.1.32, R6300v2 before 1.0.4.24, R8500 before 1.0.2.94, WNDR3400v3 before 1.0.1.18, and WN2500RPv2 before 1.0.1.52.

Weakness: CWE-79

Which versions are affected by CVE-2019-20756?

It affects 18 products.

Products include Netgear Ex3700 Firmware, Netgear Ex3800 Firmware, Netgear Ex6000 Firmware, Netgear Ex6100 Firmware, Netgear Ex6120 Firmware, Netgear Ex6130 Firmware and 12 more.

How do I fix CVE-2019-20756?

No fix has been published for CVE-2019-20756 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-20756 being exploited?

There is no known exploitation of CVE-2019-20756 in the wild and no public exploit code.

All Netgear Ex6200 Firmware vulnerabilities

Sources

Also known as GHSA-cmvh-xx7q-427v.