CVE-2019-20660

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in certain NETGEAR Orbi WiFi system models, including RBR20, RBS20, RBK20 (before firmware version 2.3.5.26) and RBR40, RBS40, RBK40, RBR50, RBS50, RBK50 (before firmware version 2.3.5.30). The vulnerability allows an attacker to inject malicious scripts that are stored on the device, which are later executed in the context of the administrative web interface [1].

Exploitation

An attacker can exploit this vulnerability by sending crafted input to the affected device without requiring authentication. The injected script is stored and subsequently executed when an administrator accesses the web management interface, leading to persistent script execution [1].

Impact

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the administrator's browser session, potentially leading to session hijacking, defacement, or theft of sensitive information. The impact is limited to the web interface and does not imply remote code execution on the device [1].

Mitigation

NETGEAR has released firmware updates to address this vulnerability: version 2.3.5.26 for RBR20, RBS20, RBK20; and version 2.3.5.30 for RBR40, RBS40, RBK40, RBR50, RBS50, RBK50. Users should update to the latest firmware via the NETGEAR Support website [1]. No workarounds are mentioned.