CVE-2019-20677

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web interface of NETGEAR Orbi WiFi system models RBR50, RBS50, and RBK50 running firmware versions prior to 2.3.5.30. The vulnerability allows an authenticated attacker with high privileges to inject malicious scripts that are stored on the device and later executed when other users access the affected page [1].

Exploitation

An attacker must have local network access and administrative privileges to the device's web interface. The attacker can inject a malicious script into a vulnerable input field, which is then stored. When another administrator views the affected page, the script executes automatically without requiring user interaction [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to disclosure of sensitive information (e.g., session tokens) and unauthorized actions on the device with the victim's privileges [1].

Mitigation

NETGEAR released firmware version 2.3.5.30 to address this vulnerability. Users should update their devices to this version or later via the NETGEAR Support website. No workarounds are provided [1].