CVE-2020-26897

Vulnerability

CVE-2020-26897 is an administrative credential disclosure vulnerability affecting certain NETGEAR WiFi system models. The following products are impacted: CBR40 before firmware version 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11 [1]. The vulnerability resides in the affected devices' firmware and allows exposure of administrative credentials without requiring authentication or prior access privileges [1].

Exploitation

Exploitation can be performed by an attacker with adjacent network access—such as being within range of the WiFi network—without needing any authentication. The advisory does not detail the exact attack vector, but the vulnerability is remotely exploitable over the local network segment, allowing an unauthenticated user to extract the admin credentials [1].

Impact

Successful exploitation results in disclosure of administrative credentials for the affected device. An attacker who obtains these credentials gains full administrative control over the device, potentially allowing further compromise of the network, modification of settings, or interception of traffic. The CVSS v3 base score is 9.6 (Critical) with a vector of AV:A/AC... indicating high severity due to the low attack complexity and no required privileges [1].

Mitigation

NETGEAR has released patched firmware versions for all affected products. Users should update to the following fixed versions or later as soon as possible: CBR40 to 2.5.0.10, RBK752/RBR750/RBS750 to 3.2.15.25, and RBK852/RBR850/RBS850 to 3.2.10.11 [1]. No workaround is provided; applying the firmware update is the only mitigation. There is no indication that this CVE is listed in the Known Exploited Vulnerabilities (KEV) catalog.