CVE-2020-26903

Vulnerability

The vulnerability is an administrative credential disclosure affecting multiple NETGEAR WiFi system models. The following models and firmware versions are impacted: CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11 [1].

Exploitation

An attacker on the same local network can exploit this vulnerability to obtain administrative credentials without authentication. The advisory does not provide specific exploitation steps, but it indicates that the disclosure occurs under certain conditions [1].

Impact

Successful exploitation allows an attacker to gain administrative credentials, leading to full control of the affected device. This can result in unauthorized access to configuration settings, network traffic interception, and potential compromise of other connected devices, impacting confidentiality and integrity [1].

Mitigation

NETGEAR has released fixed firmware versions for all affected models: CBR40 firmware version 2.5.0.10, RBK752/RBR750/RBS750 firmware version 3.2.15.25, and RBK852/RBR850/RBS850 firmware version 3.2.10.11. Users should update to these versions immediately. No workarounds are provided [1].