CVE-2020-11773

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web-based administration interface of multiple NETGEAR router and gateway models. The vulnerability stems from insufficient sanitization of user-supplied input on device configuration pages, allowing script content to be permanently stored and later executed in the context of an administrator's browser session. Affected firmware versions are: D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, XR500 before 2.3.2.56, and XR700 before 1.0.1.10 [1].

Exploitation

An attacker must first obtain administrative access to the device's web interface, or have the ability to deliver crafted input to a logged-in administrator (e.g., through a phishing link that triggers a configuration change request). Because the vulnerability is stored, the injected script remains on the device and executes each time the affected page is loaded by any authenticated administrator. No additional user interaction beyond the initial administrative action is required for the script to persist and later activate [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript within the security context of the affected router’s web interface. This can lead to session hijacking, exfiltration of sensitive configuration data (e.g., Wi-Fi passwords, VPN credentials), submission of malicious requests on behalf of the administrator, and potential further compromise of network resources. The scope of impact is limited to actions the administrator can perform from the web UI [1].

Mitigation

NETGEAR has released fixed firmware versions for all affected models as of April 2020. Users should upgrade to the following firmware: D7800 1.0.1.56, R7500v2 1.0.3.46, R7800 1.0.2.68, R8900 1.0.4.28, R9000 1.0.4.28, RAX120 1.0.0.78, XR500 2.3.2.56, XR700 1.0.1.10, or later. No workarounds are mentioned in the advisory; installing the latest firmware from NETGEAR Support is the only recommended course of action [1].