Security readout for executives and security teams
Plain-English summary
Some NETGEAR WAC505 and WAC510 wireless access points shipped with a security misconfiguration before firmware 8.0.6.4. The reported impact is limited confidentiality exposure, and exploitation requires adjacency to the network. This is not a crisis, but affected access points should be found and updated.
Executive priority
Handle through normal vulnerability remediation with attention to branch and wireless infrastructure. The issue is medium severity, not listed as actively exploited in the supplied sources, but outdated access points can create unnecessary local-network exposure.
Technical view
CVE-2019-20654 is an incorrect security configuration issue affecting NETGEAR WAC505 and WAC510 before 8.0.6.4. CVSS 3.0 score is 4.3 with adjacent attack vector, low complexity, no privileges, no user interaction, unchanged scope, and low confidentiality impact only.
Likely exposure
Organizations running NETGEAR WAC505 or WAC510 access points with firmware earlier than 8.0.6.4. CVSS AV:A indicates the attacker must be on an adjacent network, so exposure is most relevant on local wireless, guest, LAN, or branch network segments.
Exploitation context
The supplied sources do not identify active exploitation, public exploit code, or CISA KEV listing. The CVSS vector indicates low attack complexity and no authentication requirement, but exploitation requires adjacent network access and the stated impact is limited to confidentiality.
Researcher notes
Details are limited in the supplied record. No CWE, CPEs, exploit narrative, or named technical root cause beyond security misconfiguration are provided. Treat PSV-2019-0061 and firmware boundary 8.0.6.4 as the key vendor-sourced identifiers.
Mitigation direction
- Upgrade WAC505 and WAC510 devices to firmware 8.0.6.4 or later.
- Review the NETGEAR advisory for model-specific firmware and support guidance.
- Prioritize devices on guest, shared, or weakly segmented wireless networks.
- Retire or isolate devices that cannot be updated.
Validation and detection
- Inventory NETGEAR WAC505 and WAC510 access points in managed and remote sites.
- Confirm each affected device firmware version is 8.0.6.4 or later.
- Check whether affected devices are reachable from guest or untrusted local networks.
- Record remediation evidence in asset and vulnerability management systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-20654 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
4.3MediumVector: CVSS:3.0/AC:L/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000061487/Security-Advisory-for-Security-Misconfiguration-on-WAC505-and-WAC510-PSV-2019-0061CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.