Vulnerability Description
An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request (exploitable directly or through CSRF), as demonstrated by the setup.cgi?todo=save_htp_account URI.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netgear | Wnr1000 Firmware | 1.1.0.54 |
| Netgear | Wnr1000 | 4 |
Related Weaknesses (CWE)
References
- https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-Third Party Advisory
- https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-Third Party Advisory
FAQ
What is CVE-2019-20487?
CVE-2019-20487 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request (exploitable directly or th...
How severe is CVE-2019-20487?
CVE-2019-20487 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-20487?
Check the references section above for vendor advisories and patch information. Affected products include: Netgear Wnr1000 Firmware, Netgear Wnr1000.