CVE-2020-11791

Vulnerability

A reflected cross-site scripting (XSS) vulnerability affects NETGEAR JGS516PE switches running firmware versions prior to 2.6.0.43 [1]. The flaw is present in the web management interface and requires the attacker to craft a malicious link that, when clicked, reflects JavaScript in the user's browser.

Exploitation

The attacker must be on the same network (adjacent) and trick an authenticated administrator into clicking a specially crafted link [1]. No special privileges are needed beyond network adjacency and social engineering to deliver the link. The XSS payload executes in the context of the management session.

Impact

Successful exploitation allows an attacker to perform cross-site scripting attacks that can lead to limited information disclosure (e.g., session tokens, page content) and limited modification of content via the victim's session [1]. The CVSS v3 score is 5.2 (Medium), with the vector indicating network adjacency required, low attack complexity, no privileges needed, and user interaction [1].

Mitigation

NETGEAR released firmware version 2.6.0.43 to fix this vulnerability [1]. Users should update to this version or later. There is no indication that this CVE is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.