CVE-2019-20644

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in NETGEAR RAX40 router firmware versions prior to 1.0.3.62. An attacker with administrative privileges can inject malicious script code into the device's web interface, which is then stored and executed in the context of other authenticated users' browsers when they access the affected page. This issue is identified as PSV-2019-0246 [1].

Exploitation

To exploit this vulnerability, an attacker must first obtain high-privileged (administrator) access to the router's web management interface. Once authenticated, the attacker can inject persistent XSS payloads into input fields that are not properly sanitized. When other administrators view the affected page, the injected script executes in their browser session [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser, leading to partial compromise of confidentiality and integrity. The impact is limited to the browser session and does not directly provide control over the router's operating system [1].

Mitigation

NETGEAR released firmware version 1.0.3.62 to fix this vulnerability. Users should upgrade their RAX40 device to this version or later by downloading the firmware from NETGEAR Support and following the installation instructions. No workarounds are documented. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1].