CVE-2019-20487

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request (exploitable directly or through CSRF), as demonstrated by the setup.cgi?todo=save_htp_account URI.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Mar 2, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-204889.8An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerabCVE-2019-204899.8An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and othCVE-2019-20497.8In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc, there is a possible memory corruption due to a use after free. This could lead CVE-2019-204908.8cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).CVE-2019-204915.4cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).CVE-2019-204928.8cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).CVE-2019-204936.1cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).CVE-2019-204943.3In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).CVE-2019-204956.5cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).CVE-2019-204965.5cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).CVE-2019-204975.4cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).CVE-2019-204989.8cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).
CVE-2019-20487: High severity, CVSS 8.8 | Vulnix