CVE-2020-35784

Vulnerability

A missing function-level access control vulnerability affects several NETGEAR Smart Managed Plus Switch models. The affected devices are JGS516PE, JGS524PE, JGS524Ev2, and GS116Ev2 running firmware versions prior to 2.6.0.48. The flaw allows users with administrative access to perform actions that should be restricted, due to inadequate enforcement of permissions at the function level.

Exploitation

An attacker needs to have administrative access to the device's web-based management interface. No other special network position or user interaction is required beyond valid admin credentials. The attacker can then access functions that are not properly protected, bypassing intended access controls [1].

Impact

Successful exploitation could allow an authenticated administrator to gain unauthorized access to administrative functions, potentially leading to information disclosure (high confidentiality impact), modification of device configuration or data (high integrity impact), and limited availability impact (low availability impact). The CVSS v3 score is 6.2 (Medium) [1].

Mitigation

NETGEAR has released fixed firmware version 2.6.0.48 for all affected models. Users should download and install the latest firmware from the NETGEAR Support website. There are no known workarounds; updating to the patched version is the recommended mitigation [1].