|
[Japanese]
|
JVNDB-2020-000056
|
Multiple NETGEAR switching hubs vulnerable to cross-site request forgery
|
|
GS716Tv2 and GS724Tv3 switching hubs provided by NETGEAR contain a cross-site request forgery vulnerability.
Rei Yano reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 2.6 (Low) [IPA Score]
- Access Vector: Network
- Access Complexity: High
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
NETGEAR
- GS716Tv2 Firmware version 5.4.2.30 and earlier
- GS724Tv3 Firmware version 5.4.2.30 and earlier
|
|
|
If a user views a malicious page while logged in to the management screen, the product's settings may be changed unintentionally.
|
|
[Apply a workaround]
Applying the following workaround may mitigate the impacts of this vulnerability.
* Set the IP address of the product in a different network from the one used for the user port
[Stop using the products]
GS716Tv2 and GS724Tv3 are no longer supported. Stop using the products and consider switching to an alternative products.
NETGEAR offers GS716Tv3 (GS716T-300AJS) and GS724Tv4 (GS724T-400AJS) as successors to GS716Tv2 and GS724Tv3.
|
|
NETGEAR
|
|
- Cross-Site Request Forgery(CWE-352) [IPA Evaluation]
|
|
- CVE-2020-5621
|
|
- JVN : JVN#29903998
- National Vulnerability Database (NVD) : CVE-2020-5621
|
|
- [2020/08/28]
Web page was published
|
