CVE-2020-26900
Description
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
NETGEAR WiFi systems disclose administrative credentials to unauthenticated attackers on the local network, requiring a firmware update.
Vulnerability
An administrative credential disclosure vulnerability exists in multiple NETGEAR WiFi system models. Affected devices include the CBR40 (firmware before 2.5.0.10), RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 (all before 3.2.15.25) [1]. The vulnerability allows the administrative credentials to be disclosed to an unauthenticated attacker on the local network.
Exploitation
An attacker must be on the local network (adjacent) to exploit this vulnerability [1]. No authentication or user interaction is required. The attacker can obtain the administrative credentials by sending crafted requests to the affected device.
Impact
Successful exploitation results in disclosure of the administrative credentials, granting the attacker full administrative access to the device. This can lead to complete compromise of the device, including the ability to change configuration, monitor traffic, and potentially pivot to other devices on the network.
Mitigation
NETGEAR has released fixed firmware versions: CBR40 users should upgrade to 2.5.0.10 or later, and all other affected models (RBK752, RBR750, RBS750, RBK852, RBR850, RBS850) should upgrade to 3.2.15.25 or later [1]. Users should download the latest firmware from NETGEAR Support and install it as soon as possible.
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
8- NETGEAR/NETGEAR devicesdescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.