CVE-2019-20668

Vulnerability

Stored cross-site scripting (XSS) vulnerability exists in NETGEAR WiFi system models. Affected devices: RBR20, RBS20, RBK20 before firmware 2.3.5.26; and RBR40, RBS40, RBK40, RBR50, RBS50, RBK50 before firmware 2.3.5.30 [1]. The vulnerability allows an attacker to inject malicious scripts that are stored on the device.

Exploitation

An attacker with administrative access or ability to submit crafted input (e.g., via the web interface) can inject a stored XSS payload. The attacker may need to be on the local network or have valid credentials to access the management interface. The injected script executes in the context of the administrator's browser when viewing the affected page.

Impact

Successful exploitation leads to execution of arbitrary JavaScript in the context of the administrator's browser. This could result in disclosure of sensitive information, session hijacking, or unauthorized actions performed on the device. The impact is limited to the administration interface.

Mitigation

NETGEAR released fixed firmware versions: 2.3.5.26 for RBR20, RBS20, RBK20; and 2.3.5.30 for RBR40, RBS40, RBK40, RBR50, RBS50, RBK50 [1]. Users should update to these versions immediately. No workarounds are mentioned.