CVE-2020-27866
Estado: ModificadaAlta (8.8)—
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 8.66%
- Percentil entre todas las CVEs puntuadas: 95
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (19)
Netgear — Ac2100 FirmwareNetgear — Ac2400 FirmwareNetgear — Ac2600 FirmwareNetgear — R6020 FirmwareNetgear — R6080 FirmwareNetgear — R6120 FirmwareNetgear — R6220 FirmwareNetgear — R6230 FirmwareNetgear — R6260 FirmwareNetgear — R6330 FirmwareNetgear — R6350 FirmwareNetgear — R6700 FirmwareNetgear — R6800 FirmwareNetgear — R6850 FirmwareNetgear — R6900 FirmwareNetgear — R7200 FirmwareNetgear — R7350 FirmwareNetgear — R7400 FirmwareNetgear — R7450 Firmware
CWE
- CWE-288
- CWE-287
Referencias
- https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
- https://www.zerodayinitiative.com/advisories/ZDI-20-1451/
- https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
- https://www.zerodayinitiative.com/advisories/ZDI-20-1451/
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-27866",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 8.3,
"accessVector": "ADJACENT_NETWORK",
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.5,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "zdi-disclosures@trendmicro.com",
"affectedData": [
{
"vendor": "NETGEAR",
"product": "Multiple Routers",
"versions": [
{
"status": "affected",
"version": "firmware version 1.2.0.62_1.0.1"
}
]
}
]
}
],
"published": "2021-02-12T00:15:12.877",
"references": [
{
"url": "https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers",
"tags": [
"Vendor Advisory"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1451/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1451/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"description": [
{
"lang": "en",
"value": "CWE-288"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355."
},
{
"lang": "es",
"value": "Esta vulnerabilidad permite a los atacantes adyacentes a la red saltarse la autenticación en las instalaciones afectadas de los routers NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100 y Nighthawk AC2400. No se requiere autenticación para explotar esta vulnerabilidad. El fallo específico existe en el servicio mini_httpd, que escucha en el puerto TCP 80 por defecto. El problema se debe a una lógica incorrecta de coincidencia de cadenas al acceder a páginas protegidas. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código en el contexto de root. Era ZDI-CAN-11355"
}
],
"lastModified": "2026-06-17T03:09:46.177",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:ac2100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8AB0B236-6BC6-4E99-8792-6B01BD591D3A",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:ac2100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A80B06A1-81B5-4C33-89F6-EC3F6E3068B5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:ac2400_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B01C772-D1D4-41F1-A33D-72A6A672502A",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:ac2400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6B25A18F-DD96-45FE-B098-71E60CB0FFFE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:ac2600_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA359610-21DC-41C4-9430-8406B34490EB",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:ac2600:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2BFCD9A8-1846-48C4-9F14-3866E983FB74"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0FCF958-2F6A-4B79-B307-2FE23B7CE8FC",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6700:v2:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9F9706E6-CA53-43E4-91B0-D52655C86860"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6800_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA434604-4916-4830-A96B-CEC0C8E5A1A0",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "09404083-B00B-4C1F-8085-BC242E625CA3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6900_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E9457F1-F5E8-43CA-8697-3849E140B0CC",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6900:v2:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2E8EB69B-6619-47B6-A073-D0B840D4EB0B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D95583A-EC79-41FF-9496-DAB19A1A34DB",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FECB83F9-D417-4FD3-B293-87BC177E3AEB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7350_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53B1B947-2E36-463C-848F-C5F5C0A5ECAF",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7350:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AFD1A65C-F10F-4C52-8B6D-69992E512EB5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7400_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A188F6E-5296-4511-97F2-9328B1E1F6CF",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1F68AC3B-A31F-4AB0-89E9-BFFDE427AD3B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7450_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33043216-4563-4195-88D7-93446302ECD1",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7450:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6DA5420D-DD64-4A9C-9B5F-784F0ED2B464"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E662BF37-5D81-4B9F-898E-F91B09821555",
"versionEndExcluding": "1.1.0.104"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6220:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B131B5C8-CB7F-433B-BA32-F05CE0E92A66"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6230_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CD4B6F1-E58F-4B96-BF51-729F59FA1C8B",
"versionEndExcluding": "1.1.0.104"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6230:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C91CADFA-59DB-4B6C-A914-848884F4A4BD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6260_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33824B9B-1224-484A-AFF4-953573F299C6",
"versionEndExcluding": "1.1.0.78"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6260:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3C395D49-57F9-4BC1-8619-57127355B86B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6330_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBA2E978-FFF7-470D-90BA-4DBDC009B076",
"versionEndExcluding": "1.1.0.78"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6330:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D621D26D-B144-424A-A9CB-19488399ACC1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6350_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2AE3CE4-23B0-467E-B522-A211048D6AF3",
"versionEndExcluding": "1.1.0.78"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6350:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4B302909-29CF-4E53-9CCB-8664D3FCB03A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6850_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "612DAD20-761D-41D5-A6AB-AA9975847D34",
"versionEndExcluding": "1.1.0.78"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "598B48C5-4706-4431-8C5A-DA496DD1052F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6120_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B373C515-681A-4D80-9BFD-5E2DFD6F2DF0",
"versionEndExcluding": "1.0.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D18D2CCD-424F-41D5-919B-E22B9FA68D36"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6020_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6EC58A4B-E061-49ED-BB2D-E0497846DBEE",
"versionEndExcluding": "1.0.0.48"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6020:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5DDA7ABF-4C4B-4945-993A-F93BD8FCB55E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6080_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF9D1B97-7FF8-45D9-BFD6-72554BBB6008",
"versionEndExcluding": "1.0.0.48"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6080:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1CEB5C49-53CF-44AE-9A7D-E7E6201BFE62"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "zdi-disclosures@trendmicro.com"
}