Experts found 15 flaws in Netgear JGS516PE, including a critical RCE
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-26919 | Missing Function-Level Access Control in NETGEAR JGS516PE Smart Managed Switches CVE-2020-26919 is a missing function-level access control flaw in NETGEAR JGS516PE ProSAFE 16-port Gigabit PoE+ Smart Managed Plus switches running firmware before 2.6.0.43. An unauthenticated remote attacker can invoke privileged switch functions over the network without authorization, consistent with the CVSS 9.8 critical score (network vector, no privileges or user interaction required). Successful exploitation grants the attacker full functional control of the switch's management functions, with high impact on confidentiality, integrity, and availability of the device. Any organization or site running a JGS516PE switch on affected firmware is exposed, particularly where the management interface is reachable from untrusted networks. The flaw is listed in the CISA Known Exploited Vulnerability Catalog (added 2021-11-03), indicating it is known to be exploited in the wild, and related reporting on Mirai variants targeting network devices suggests active scanning and botnet interest in this class of equipment. Do: Upgrade JGS516PE switch firmware to version 2.6.0.43 or later per NETGEAR's instructions, as required by the CISA KEV listing. Restrict the switch's management interface (web and network management protocols) to trusted management VLANs or administrative networks and avoid internet exposure. Check whether the device appears in KEV-driven scanning activity and monitor for Mirai-style botnet targeting of network infrastructure. | 9.8 | 57% | KEV |
| largeon the order of tens of thousands of deployed JGS516PE switches, with a likely lower but non-trivial subset (thousands to tens of thousands) having management… | |
| CVE-2020-35220 +1 in the same advisory: …35232 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-35801. Reason: This candidate is a reservation duplicate of CVE-2020-35801. Notes: All CVE users should reference CVE-2020-35801 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage NVD description · AI analysis pending | — | — | — | — | ||
| CVE-2020-35231 +1 in the same advisory: …35233 | The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of the device. NVD description · AI analysis pending | 8.8 group max | 1% |
| — |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 2.6.0.43 | al management web application in firmware versions prior to 2.6.0.43, it could be exploited by unauthenticated attackers to bypa |
Full article619 words · extracted from securityaffairs.com · click to collapse
Netgear has released security and firmware updates for its JGS516PE Ethernet switch to address 15 vulnerabilities, including a critica remote code execution issue.
Netgear has released security and firmware updates to address 15 vulnerabilities in its JGS516PE Ethernet switch, including an unauthenticated remote code execution flaw rated as critical.
The flaws were discovered by researchers at NCC Group IT, most of them affect the NSDP protocol, which is still enabled for legacy reasons, to allow customers to use Prosafe Plus.
The most severe flaw is a critical RCE tracked as CVE-2020-26919 and rated with a CVSS v3 score of 9.8, the remaining flaws are nine high-severity issues and a five medium-rated bugs.
The CVE-2020-26919 resides in the switch internal management web application in firmware versions prior to 2.6.0.43, it could be exploited by unauthenticated attackers to bypass authentication and execute actions with administrator privileges.
“The switch internal management web application in firmware versions prior to 2.6.0.43 failed to correctly implement access controls in one of its endpoints, allowing unauthenticated attackers to bypass authentication and execute actions with administrator privileges.” reads the advisory published by NCC Group.”
“It was found that every section of the web could be used as a valid endpoint to submit POST requests being the action defined by the submitId argument. The problem was located in the login.html webpage, that has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow users execute system commands.”
Another vulnerability addressed by the vendor is an NSDP Authentication Bypass tracked as CVE-2020-35231 rated with CVSS v3 score of 8.8.
The Netgear Switch Management Protocol (NSDP) is a proprietary protocol used as discovery method with the ability to manage the switch configuration. The NSDP it is used by “Netgear Switch Discovery Tool” and “ProSafe Plus Configuration Utility” software.
“A remote unauthenticated attacker can send specially crafted authentication packages to execute any management actions in the device, including wiping the configuration by executing a factory restoration.” states the advisory.
Experts also found an Unauthenticated Firmware Update Mechanism tracked as CVE-2020-35220. The researchers discovered a TFTP server with the ability to update firmware that is active by default, it could allow external attackers to upload tainted firmware updates without requiring administrative credentials.
“An external attacker could use this vulnerability to upload outdated versions of the firmware containing other vulnerabilities, upload invalid data to left the device bricked or even upload custom firmware files that may include malicious code, such as backdoors.” states the advisory.
Netgear published firmware updates for the JGS516PE switch on its website, the latest version available for download is 2.6.0.48.
Below the timeline for these vulnerabilities:
- 01 Sep 2020 – First contact with the vendor.
- 05 Sep 2020 – Vulnerabilities details reported to Netgear.
- 17 Sep 2020 – Netgear published a security advisory for the most critical issue.
- 29 Oct 2020 – Call with Netgear team to discuss vulnerabilities, CVSS ratings and remediation plan.
- 02 Dec 2020 – Netgear released the new firmware v2.6.0.48 including fixes for CVE-2020-35220, CVE-2020-35232, CVE-2020-35233 and other minor issues. NCC Group was informed that there are no future plans to fix the other issues.
- 16 Dec 2021 – Start the process to coordinate the publication of this document.
- 11 Jan 2021 – First draft shared with Netgear.
- 27 Jan 2021 – Remediation actions were agreed. An initial paragraph reflecting Netgear’s posture was also added.
- 08 Mar 2021 – Technical Advisory published by NCC Group.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Netgear)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/115586/hacking/netgear-soho-flaws.html