CVE-2020-26928

Vulnerability

An authentication bypass vulnerability exists in multiple NETGEAR WiFi system models, including CBR40, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850. Affected versions are firmware prior to 2.5.0.10 for CBR40, prior to 3.2.15.25 for RBK752/RBR750/RBS750, and prior to 3.2.10.11 for RBK852/RBR850/RBS850 [1]. The vulnerability allows an attacker to bypass authentication mechanisms without requiring any credentials.

Exploitation

An unauthenticated attacker on the same local network (adjacent) can exploit this vulnerability by sending specially crafted packets to the affected device. No user interaction or prior authentication is required. The CVSS vector confirms the attack complexity is low and no privileges are needed [1].

Impact

Successful exploitation results in full authentication bypass, which could allow the attacker to gain administrative access to the device. This can lead to complete compromise of confidentiality, integrity, and availability of the affected WiFi system [1].

Mitigation

NETGEAR has released fixed firmware versions: 2.5.0.10 for CBR40, 3.2.15.25 for RBK752/RBR750/RBS750, and 3.2.10.11 for RBK852/RBR850/RBS850 [1]. Users are strongly advised to download and install the latest firmware from NETGEAR Support [1]. No workarounds are documented in the available references.