CVE-2020-11551: netgear rbs50y_firmware Improper Authentication

Vulnerability summary

CVE-2020-11551 is a critical (CVSS 9.6) Improper Authentication vulnerability in netgear rbs50y_firmware. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76.1% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 18-05-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote write of arbitrary Wi-Fi configuration data such as authentication details (e.g., the Web-admin password), network settings, DNS settings, system administration interface configuration, etc.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.