Paper/Archive/CVE-2020-11551

CVE-2020-11551

mitre — An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.…

EPSS 2%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 76.5.765 × 2015.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote write of arbitrary Wi-Fi configuration data such as authentication details (e.g., the Web-admin password), network settings, DNS settings, system administration interface configuration, etc.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

mitre (CNA)9.6CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N

References

refmodzero.com/advisories/MZ-20-02-Netgear-Orbi-Pro-Security.txt refmodzero.com/modlog/archives/2020/05/18/how_netgear_meshed_up_wifi_for_business/index.html refgithub.com/modzero/MZ-20-02-NETGEAR-Orbi-Security