Threat Investigation
Request a demo

CVE-2020-35783

Medium

Description

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, GS116Ev2 before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and JGS524PE before 2.6.0.48. The NSDP protocol version allows unauthenticated remote attackers to obtain all the switch configuration parameters by sending the corresponding read requests.

SeverityMedium
CVSS6.5
Exploit probability—
ProductNetgear Jgs516pe Firmware
PublishedDec 30, 2020
First seenDec 30, 2020

How to fix

Update
  • netgear jgs516pe_firmware2.6.0.48 or later
  • netgear jgs524e_firmware2.6.0.48 or later
  • netgear jgs524pe_firmware2.6.0.48 or later
  • netgear gs116e_firmware2.6.0.48 or later

Affected products

ProductAffected versionsFixed in
netgear jgs516pe_firmwarev < 2.6.0.482.6.0.48
netgear jgs524e_firmwarev < 2.6.0.482.6.0.48
netgear jgs524pe_firmwarev < 2.6.0.482.6.0.48
netgear gs116e_firmwarev < 2.6.0.482.6.0.48

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.