CVE-2020-35221

Published: Mar 10, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The hashing algorithm implemented for NSDP password authentication on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was found to be insecure, allowing attackers (with access to a network capture) to quickly generate multiple collisions to generate valid passwords, or infer some parts of the original.

Affected (2)

Products: Netgear: Gs116e Firmware, Jgs516pe Firmware

2 products

Gs116e Firmware

Jgs516pe Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Gs116e Firmware	Version 2.6.0.43

Running on/with	Platform Versions
Netgear Gs116e	Version v2

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Jgs516pe Firmware	Version 2.6.0.43

Running on/with	Platform Versions
Netgear Jgs516pe	All versions

Related CWEs

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (2)

https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/

Source: cve@mitre.org

Vendor Advisory

https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.