CVE-2019-20489: Critical severity netgear wnr1000v3 firmware vulnerability
An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FWremote.htm&todo=cfginit request without a cookie, reads the Set-Cookie header in the 401 Unauthorized response, and then repeats the FWremote.htm&todo=cfginit request with the specified cookie.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-20489?
The severity of CVE-2019-20489 is critical with a severity score of 9.8.
What is the affected software for CVE-2019-20489?
The affected software for CVE-2019-20489 is NETGEAR WNR1000V4 firmware version 1.1.0.54.
How can an attacker exploit CVE-2019-20489?
An attacker can exploit CVE-2019-20489 by using an authentication bypass and other vulnerabilities in the web management interface to remotely compromise the device from a malicious webpage.
Is NETGEAR WNR1000 version 4 vulnerable to CVE-2019-20489?
No, NETGEAR WNR1000 version 4 is not vulnerable to CVE-2019-20489.
Where can I find more information about CVE-2019-20489?
You can find more information about CVE-2019-20489 at the following link: [https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/](https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/)