{"id":"CVE-2020-27866","published":"2021-02-11T23:35:39Z","modified":"2024-08-04T16:25:43Z","title":"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR…","vendor":"NETGEAR","product":"Multiple Routers","tier":"core","eol":null,"affectedVersions":[{"vendor":"NETGEAR","product":"Multiple Routers","versions":["firmware version 1.2.0.62_1.0.1"]}],"description":{"text":"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw lies in the mini_httpd web service, which listens on TCP port 80 by default, on multiple NETGEAR routers including the R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100 and Nighthawk AC2400, where incorrect string matching logic in access to protected pages causes an authentication bypass. A network-adjacent attacker can exploit this without authentication or user interaction to bypass authentication, and it can be chained with other vulnerabilities to execute code as root.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:34Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.08656,"percentile":0.95102,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-12-14","exploitedFirstSeen":"2026-02-02","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2020-27866","date":"2026-02-02"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers","tags":["x_refsource_MISC"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1451/","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-20359","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-20359","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2020-27866","name":"NETGEAR - Authentication Bypass","severity":"high","path":"http/cves/2020/CVE-2020-27866.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-27866.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-02-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-27866","provenance":"source"},{"date":"2026-02-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2020-27866","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":70.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 319 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.02,"detail":"percentile 0.9510"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"children":[{"from":"CVE-2020-27866","to":"CVE-2021-35973","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"…15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by adding the &currentsetting.htm substring to the HTTP query, a related issue to CVE-2020-27866.","from":"CVE.org","in":"CVE-2021-35973"}]}]}}