NETGEAR GS116E Firmware vulnerabilities

18 CVEs affecting NETGEAR GS116E Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-35233, published 2021-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-35801, published 2020-12-30. High severity, CVSS 7.3. EPSS: 1.7% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before…
CVE-2020-35782, published 2020-12-30. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before…
CVE-2020-35783, published 2020-12-30. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, GS116Ev2 before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and JGS524PE before…
CVE-2020-35227, published 2021-03-10. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices (in the administration web panel) allows an attacker to inject IP addresses into the…
CVE-2020-35231, published 2021-03-10. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of…
CVE-2020-35784, published 2020-12-30. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and GS116Ev2 before…
CVE-2020-35228, published 2021-03-10. Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2020-35229, published 2021-03-10. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated and can be reused until a new token is generated, which…
CVE-2020-35224, published 2021-03-10. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A buffer overflow vulnerability in the NSDP protocol authentication method on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote unauthenticated attackers to force a device reboot.
CVE-2020-35225, published 2021-03-10. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was not properly validating the length of string parameters sent in write requests, potentially allowing denial of…

Latest

CVE-2020-35233, published 2021-03-10. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, and allows external attackers to force device reboots by sending concurrent connections, aka a…
CVE-2020-35230, published 2021-03-10. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices. Most of the integer parameters sent through the web server can be…
CVE-2020-35226, published 2021-03-10. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP configuration by sending the corresponding write request command.
CVE-2020-35223, published 2021-03-10. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed by omitting the CSRF token parameter in HTTP requests.