What is CVE-2020-26917?

CVE-2020-26917 is a medium-severity vulnerability in NETGEAR Ex7000, classified under Cross-site Scripting. CVSS score: 4.1/10. Published 2020-10-09.

How severe is CVE-2020-26917?

Medium severity. CVSS v3 base score is 4.1 out of 10.

XSS in NETGEAR Ex7000

CVE-2020-26917

Certain NETGEAR devices are affected by stored XSS. This affects EX7000 before 1.0.1.78, R6250 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.8, R8300 before 1.0.2.128, and R8500 before 1.0.2.128.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (45.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L.

Affected products

Netgear Ex7000
Netgear Ex7000_firmware
Netgear R6250
Netgear R6250_firmware
Netgear R6400
Netgear R6400_firmware
Netgear R6400v2
Netgear R6400v2_firmware
Netgear R7100lg
Netgear R7100lg_firmware

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-26917?: CVE-2020-26917 is a medium-severity vulnerability in NETGEAR Ex7000, classified under Cross-site Scripting. CVSS score: 4.1/10. Published 2020-10-09.
How severe is CVE-2020-26917?: Medium severity. CVSS v3 base score is 4.1 out of 10.