5.8
CVSSv2

CVE-2020-11551

Published: 18/05/2020 Updated: 21/07/2021
CVSS v2 Base Score: 5.8 | Impact Score: 6.4 | Exploitability Score: 6.5
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 516
Vector: AV:A/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

An issue exists on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satellite (RBS50Y) V2.5.1.106, and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The administrative SOAP interface allows an unauthenticated remote write of arbitrary Wi-Fi configuration data such as authentication details (e.g., the Web-admin password), network settings, DNS settings, system administration interface configuration, etc.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

netgear rbs50y_firmware 2.5.1.106

netgear srr60_firmware 2.5.1.106

netgear srs60_firmware 2.5.1.106

Github Repositories

NETGEAR Orbi Pro Mesh WiFi System - Proof of Concept Exploits and additional information in security advisory MZ-20-02

MZ-20-02-NETGEAR-Orbi-Security NETGEAR Orbi Pro Mesh WiFi System - Proof of Concept Exploits and additional information in security advisory MZ-20-02 General Information A detailed security advisory is available at wwwmodzerocom/advisories/MZ-20-02-Netgear-Orbi-Pro-Securitytxt A screencast video of the setup and Proof-of-Concept exploit is available here: you