CVE-2020-11779

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web-based administration interface of several NETGEAR router and gateway models. The flaw affects specifically the following models and firmware versions: D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, XR500 before 2.3.2.56, and XR700 before 1.0.1.10. An attacker with access to a configuration input field can inject malicious script code that is stored on the device and later executed when an administrator views the affected page [1].

Exploitation

To exploit this vulnerability, an attacker must have authenticated access to the device's web-based administration interface and the ability to modify a vulnerable configuration parameter. The attacker crafts a payload containing JavaScript code and enters it into a field that lacks proper output encoding. When the administrator subsequently visits the page displaying the stored input, the injected script executes in the context of the admin's browser session. No additional user interaction beyond the administrator's normal page view is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript code in the context of the authenticated administrator's browser session. This can lead to session hijacking, unauthorized configuration changes, credential theft, or further compromise of the device and connected network resources. The impact is contained to the browser session of the administrative user [1].

Mitigation

NETGEAR has released fixed firmware versions for all affected models. Users should immediately update each device to the latest firmware as listed: D7800 to 1.0.1.56, R7500v2 to 1.0.3.46, R7800 to 1.0.2.68, R8900 to 1.0.4.28, R9000 to 1.0.4.28, RAX120 to 1.0.0.78, XR500 to 2.3.2.56, and XR700 to 1.0.1.10. The fixed versions were made available on or before the advisory publication date (April 15, 2020). No workarounds are documented; patching is the only recommended remediation [1].