8.3
CVSSv2

CVE-2020-11549

Published: 18/05/2020 Updated: 20/05/2020
CVSS v2 Base Score: 8.3 | Impact Score: 10 | Exploitability Score: 6.5
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 739
Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

An issue exists on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The root account has the same password as the Web-admin component. Thus, by exploiting CVE-2020-11551, it is possible to achieve remote code execution with root privileges on the embedded Linux system.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

netgear rbs50y_firmware 2.5.1.106

netgear srr60_firmware 2.5.1.106

netgear srs60_firmware 2.5.1.106

Github Repositories

NETGEAR Orbi Pro Mesh WiFi System - Proof of Concept Exploits and additional information in security advisory MZ-20-02

MZ-20-02-NETGEAR-Orbi-Security NETGEAR Orbi Pro Mesh WiFi System - Proof of Concept Exploits and additional information in security advisory MZ-20-02 General Information A detailed security advisory is available at wwwmodzerocom/advisories/MZ-20-02-Netgear-Orbi-Pro-Securitytxt A screencast video of the setup and Proof-of-Concept exploit is available here: you