NETGEAR MR1100 Firmware vulnerabilities

5 CVEs affecting NETGEAR MR1100 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-20679, published 2020-04-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-14527, published 2019-08-14. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication.
CVE-2019-20679, published 2020-04-15. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. NETGEAR MR1100 devices before 12.06.08.00 are affected by lack of access control at the function level.
CVE-2019-20649, published 2020-04-15. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of sensitive information.
CVE-2019-20638, published 2020-04-15. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of administrative credentials.
CVE-2019-14526, published 2019-08-14. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and…