CVE-2019-20664

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web interface of certain NETGEAR WiFi system models. The affected devices include RBR20, RBS20, RBK20 (before firmware version 2.3.5.26), and RBR40, RBS40, RBK40, RBR50, RBS50, RBK50 (before firmware version 2.3.5.30). The vulnerability allows an authenticated user to inject arbitrary JavaScript code that is stored on the device and later executed in the context of other users' browsers.

Exploitation

An attacker requires authenticated access to the router's administrative interface. The attacker can then provide malicious input to an unspecified field (likely a configuration parameter) that is not properly sanitized. When an administrator views the affected page, the injected script executes in their browser session.

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the victim's admin session. This can lead to session hijacking, unauthorized actions, or theft of sensitive credentials. The attack does not require any user interaction beyond the victim viewing the affected page.

Mitigation

NETGEAR has released fixed firmware versions: 2.3.5.26 for the RBR20, RBS20, RBK20 series, and 2.3.5.30 for the RBR40, RBS40, RBK40, RBR50, RBS50, RBK50 series. Users should update to the latest firmware via the NETGEAR Support website. No workarounds are available [1].