CVE-2020-5621

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in NETGEAR switching hubs (GS716Tv2 Firmware version 5.4.2.30 and earlier, and GS724Tv3 Firmware version 5.4.2.30 and earlier) allow remote attackers to hijack the authentication of administrators and alter the settings of the device via unspecified vectors.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Neuroinformatics Unit, Integrative Computational Brain Science Collaboration Division, RIKEN Center for Brain Science	Multiple NETGEAR switching hubs	GS716Tv2 Firmware version 5.4.2.30 and earlier, and GS724Tv3 Firmware version 5.4.2.30 and earlier

References

http://jvn.jp/en/jp/JVN29903998/index.htmlThird Party Advisory
https://jvn.jp/en/jp/JVN29903998/index.htmlThird Party Advisory
https://www.netgear.com/support/product/gs716Tv2.aspxPatch, Vendor Advisory
https://www.netgear.com/support/product/gs724tv3.aspxPatch, Vendor Advisory
http://jvn.jp/en/jp/JVN29903998/index.htmlThird Party Advisory
https://jvn.jp/en/jp/JVN29903998/index.htmlThird Party Advisory
https://www.netgear.com/support/product/gs716Tv2.aspxPatch, Vendor Advisory
https://www.netgear.com/support/product/gs724tv3.aspxPatch, Vendor Advisory

Timeline

Published: Aug 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-56227.5Shadankun Server Security Type (excluding normal blocking method types) Ver.1.5.3 and earlier allows remote attackers to cause a denial of s CVE-2020-56236.1NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to CVE-2020-56249.8SQL injection vulnerability in the XooNIps 3.48 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vector CVE-2020-56256.1Cross-site scripting vulnerability in XooNIps 3.48 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors CVE-2020-56268.8Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arbitrary OS commands vi CVE-2020-56276.1Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerabl CVE-2020-56286.5UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable A CVE-2020-56296.5UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App CVE-2020-56316.1Stored cross-site scripting vulnerability in CMONOS.JP ver2.0.20191009 and earlier allows remote attackers to inject arbitrary script via un CVE-2020-56327.8InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.CVE-2020-56339.8Multiple NEC products (Express5800/T110j, Express5800/T110j-S, Express5800/T110j (2nd-Gen), Express5800/T110j-S (2nd-Gen), iStorage NS100Ti,CVE-2020-56348.8ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware vers