CVE-2020-35782

Vulnerability

The vulnerability is a missing function-level access control in the TFTP firmware update mechanism of certain NETGEAR smart managed Plus switches. This allows remote attackers to write arbitrary data to internal memory because the firmware validation is not properly implemented. Affected models include JGS516PE, JGS524Ev2, JGS524PE, and GS116Ev2 running firmware versions prior to 2.6.0.48 [2].

Exploitation

An attacker on the adjacent network can send crafted TFTP packets to the switch without authentication. The lack of access control and improper firmware validation enables the attacker to bypass security checks and write arbitrary data to internal memory. No user interaction is required.

Impact

Successful exploitation allows the attacker to overwrite firmware or configuration data, leading to high integrity and availability impact (CVSS I:H, A:H). This could result in denial of service or persistent compromise of the device. Confidentiality is not affected.

Mitigation

NETGEAR released firmware version 2.6.0.48 to fix this vulnerability. Users should update their devices to the latest firmware as soon as possible. No workarounds are available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing [2].