What is the CVSS score of CVE-2020-35801?

CVE-2020-35801 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 1.7%.

Jgs516Pe Firmware CVE-2020-35801

HIGH

2020-12-30 cve@mitre.org

Netgear Information Disclosure Jgs516Pe Firmware Jgs524E Firmware Jgs524Pe Firmware Gs116E Firmware

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 30, 2020 - 00:15 nvd

HIGH 7.3

DescriptionNVD

AnalysisAI

Certain NETGEAR devices are affected by incorrect configuration of security settings. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0.48, JGS524Ev2 before 2.6.0.48, JGS524PE before 2.6.0.48, and GS116Ev2 before 2.6.0.48. A TFTP server was found to be active by default. It allows remote authenticated users to update the switch firmware. Affected products include: Netgear Jgs516Pe Firmware, Netgear Jgs524E Firmware, Netgear Jgs524Pe Firmware, Netgear Gs116E Firmware. Version information: before 2.6.0.48.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.