CVE-2020-11777

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of multiple NETGEAR router and gateway models. The vulnerability affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, XR500 before 2.3.2.56, and XR700 before 1.0.1.10 [1]. The flaw allows an attacker to store arbitrary JavaScript or HTML in a field that is later rendered to an administrator or other user, leading to script execution in the context of the affected application.

Exploitation

An attacker must have network access to the device's web interface and the ability to submit input that is not properly sanitized. The attacker can craft a malicious payload and inject it into a vulnerable parameter (e.g., a configuration field). When an administrator or other user views the affected page, the stored script executes in their browser. No authentication is required for the injection if the vulnerable endpoint is exposed, but the advisory does not specify exact preconditions; however, stored XSS typically requires the attacker to have some level of access to submit data.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement, redirection to malicious sites, or theft of sensitive information displayed on the interface. The impact is limited to the web application's domain and does not directly provide code execution on the device itself.

Mitigation

NETGEAR has released firmware updates to address this vulnerability. Users should update to the following fixed versions: D7800 firmware 1.0.1.56, R7500v2 firmware 1.0.3.46, R7800 firmware 1.0.2.68, R8900 firmware 1.0.4.28, R9000 firmware 1.0.4.28, RAX120 firmware 1.0.0.78, XR500 firmware 2.3.2.56, and XR700 firmware 1.0.1.10 [1]. No workarounds are provided; updating firmware is the recommended mitigation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.