NETGEAR JGS516PE Firmware vulnerabilities

20 CVEs affecting NETGEAR JGS516PE Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-35233, published 2021-03-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-26919: Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability, published 2020-10-09. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 57.5% chance of exploitation in the next 30 days. NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
CVE-2020-35801, published 2020-12-30. High severity, CVSS 7.3. EPSS: 1.7% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before…
CVE-2020-35782, published 2020-12-30. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before…
CVE-2020-35783, published 2020-12-30. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, GS116Ev2 before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and JGS524PE before…
CVE-2020-35227, published 2021-03-10. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. A buffer overflow vulnerability in the access control section on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices (in the administration web panel) allows an attacker to inject IP addresses into the…
CVE-2020-35231, published 2021-03-10. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of…
CVE-2020-35784, published 2020-12-30. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0.48, JGS524PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, and GS116Ev2 before…
CVE-2020-35228, published 2021-03-10. Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2020-35229, published 2021-03-10. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated and can be reused until a new token is generated, which…
CVE-2020-35224, published 2021-03-10. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. A buffer overflow vulnerability in the NSDP protocol authentication method on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote unauthenticated attackers to force a device reboot.

Latest

CVE-2020-35233, published 2021-03-10. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, and allows external attackers to force device reboots by sending concurrent connections, aka a…
CVE-2020-35230, published 2021-03-10. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices. Most of the integer parameters sent through the web server can be…
CVE-2020-35226, published 2021-03-10. High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days. NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allow unauthenticated users to modify the switch DHCP configuration by sending the corresponding write request command.
CVE-2020-35225, published 2021-03-10. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was not properly validating the length of string parameters sent in write requests, potentially allowing denial of…
CVE-2020-35223, published 2021-03-10. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. The CSRF protection mechanism implemented in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices could be bypassed by omitting the CSRF token parameter in HTTP requests.