CVE-2020-27872
Estado: ModificadaAlta (8.8)—
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from improper state tracking in the password recovery process. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11365.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.90%
- Percentil entre todas las CVEs puntuadas: 58
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (19)
Netgear — Ac2100 FirmwareNetgear — Ac2400 FirmwareNetgear — Ac2600 FirmwareNetgear — R6020 FirmwareNetgear — R6080 FirmwareNetgear — R6120 FirmwareNetgear — R6220 FirmwareNetgear — R6230 FirmwareNetgear — R6260 FirmwareNetgear — R6330 FirmwareNetgear — R6350 FirmwareNetgear — R6700 FirmwareNetgear — R6800 FirmwareNetgear — R6850 FirmwareNetgear — R6900 FirmwareNetgear — R7200 FirmwareNetgear — R7350 FirmwareNetgear — R7400 FirmwareNetgear — R7450 Firmware
CWE
- CWE-642
- CWE-668
Referencias
- https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
- https://www.zerodayinitiative.com/advisories/ZDI-21-071/
- https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers
- https://www.zerodayinitiative.com/advisories/ZDI-21-071/
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-27872",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5.8,
"accessVector": "ADJACENT_NETWORK",
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.5,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "zdi-disclosures@trendmicro.com",
"affectedData": [
{
"vendor": "NETGEAR",
"product": "R7450",
"versions": [
{
"status": "affected",
"version": "1.2.0.62_1.0.1"
}
]
}
]
}
],
"published": "2021-02-04T17:15:13.293",
"references": [
{
"url": "https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers",
"tags": [
"Vendor Advisory"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-071/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-071/",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"description": [
{
"lang": "en",
"value": "CWE-642"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-668"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from improper state tracking in the password recovery process. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11365."
},
{
"lang": "es",
"value": "Esta vulnerabilidad permite a atacantes adyacentes a la red omitir la autenticación en las instalaciones afectadas de los enrutadores NETGEAR R7450 versión 1.2.0.62_1.0.1. No es requerida una autenticación para explotar esta vulnerabilidad. El fallo específico se presenta dentro del servicio mini_httpd, que escucha en el puerto TCP 80 por defecto. El problema resulta de un seguimiento inapropiado del estado en el proceso de recuperación de la contraseña. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código en el contexto root. Fue ZDI-CAN-11365"
}
],
"lastModified": "2026-06-17T03:09:46.927",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:ac2100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8AB0B236-6BC6-4E99-8792-6B01BD591D3A",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:ac2100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A80B06A1-81B5-4C33-89F6-EC3F6E3068B5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:ac2400_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B01C772-D1D4-41F1-A33D-72A6A672502A",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:ac2400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6B25A18F-DD96-45FE-B098-71E60CB0FFFE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:ac2600_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA359610-21DC-41C4-9430-8406B34490EB",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:ac2600:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2BFCD9A8-1846-48C4-9F14-3866E983FB74"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0FCF958-2F6A-4B79-B307-2FE23B7CE8FC",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6700:v2:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9F9706E6-CA53-43E4-91B0-D52655C86860"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6800_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA434604-4916-4830-A96B-CEC0C8E5A1A0",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6800:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "09404083-B00B-4C1F-8085-BC242E625CA3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6900_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E9457F1-F5E8-43CA-8697-3849E140B0CC",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6900:v2:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2E8EB69B-6619-47B6-A073-D0B840D4EB0B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7200_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D95583A-EC79-41FF-9496-DAB19A1A34DB",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FECB83F9-D417-4FD3-B293-87BC177E3AEB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7350_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53B1B947-2E36-463C-848F-C5F5C0A5ECAF",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7350:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AFD1A65C-F10F-4C52-8B6D-69992E512EB5"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7400_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A188F6E-5296-4511-97F2-9328B1E1F6CF",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1F68AC3B-A31F-4AB0-89E9-BFFDE427AD3B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r7450_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33043216-4563-4195-88D7-93446302ECD1",
"versionEndExcluding": "1.2.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r7450:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6DA5420D-DD64-4A9C-9B5F-784F0ED2B464"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E662BF37-5D81-4B9F-898E-F91B09821555",
"versionEndExcluding": "1.1.0.104"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6220:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B131B5C8-CB7F-433B-BA32-F05CE0E92A66"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6230_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CD4B6F1-E58F-4B96-BF51-729F59FA1C8B",
"versionEndExcluding": "1.1.0.104"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6230:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C91CADFA-59DB-4B6C-A914-848884F4A4BD"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6260_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33824B9B-1224-484A-AFF4-953573F299C6",
"versionEndExcluding": "1.1.0.78"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6260:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3C395D49-57F9-4BC1-8619-57127355B86B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6330_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBA2E978-FFF7-470D-90BA-4DBDC009B076",
"versionEndExcluding": "1.1.0.78"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6330:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D621D26D-B144-424A-A9CB-19488399ACC1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6350_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2AE3CE4-23B0-467E-B522-A211048D6AF3",
"versionEndExcluding": "1.1.0.78"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6350:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4B302909-29CF-4E53-9CCB-8664D3FCB03A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6850_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "612DAD20-761D-41D5-A6AB-AA9975847D34",
"versionEndExcluding": "1.1.0.78"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6850:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "598B48C5-4706-4431-8C5A-DA496DD1052F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6120_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B373C515-681A-4D80-9BFD-5E2DFD6F2DF0",
"versionEndExcluding": "1.0.0.76"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D18D2CCD-424F-41D5-919B-E22B9FA68D36"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6020_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6EC58A4B-E061-49ED-BB2D-E0497846DBEE",
"versionEndExcluding": "1.0.0.48"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6020:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5DDA7ABF-4C4B-4945-993A-F93BD8FCB55E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:r6080_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF9D1B97-7FF8-45D9-BFD6-72554BBB6008",
"versionEndExcluding": "1.0.0.48"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:r6080:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1CEB5C49-53CF-44AE-9A7D-E7E6201BFE62"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "zdi-disclosures@trendmicro.com"
}