CVE-2019-20487: CSRF

Published Mar 2, 2020

Updated

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request (exploitable directly or through CSRF), as demonstrated by the setup.cgi?todo=savehtpaccount URI.

Affected Software

2 affected components

Netgear Wnr1000 Firmware=1.1.0.54

Netgear WNR1000=4

Event History

Mar 2, 2020

CVE Published

via MITRE·03:06 PM

Data Sourced

via MITRE·03:06 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2019-20487.

What is the severity of CVE-2019-20487?

The severity of CVE-2019-20487 is high with a severity value of 8.8.

Which devices are affected by CVE-2019-20487?

NETGEAR WNR1000V4 1.1.0.54 devices are affected by CVE-2019-20487.

How can the vulnerability CVE-2019-20487 be exploited?

The vulnerability CVE-2019-20487 can be exploited through an unauthenticated GET request, either directly or through CSRF, in the WNR1000V4 web management console.

Are there any fixes or patches available for CVE-2019-20487?

At this time, there might not be an official fix or patch available for CVE-2019-20487. It is recommended to contact NETGEAR or check their website for any updates or security advisories regarding this vulnerability.