Security readout for executives and security teams
Plain-English summary
Some NETGEAR routers and gateways have a pre-authentication memory corruption flaw. An unauthenticated attacker on the required network path could severely affect device confidentiality, integrity, and availability. Treat impacted devices as high priority infrastructure risk, especially where they protect branch, home-office, or small-office networks.
Executive priority
Prioritize remediation where affected devices sit at network edges, offices, or remote-worker environments. The impact is high, but the available sources indicate adjacent-network scope and do not confirm active exploitation.
Technical view
CVE-2019-20684 is a stack-based buffer overflow in certain NETGEAR devices. CVSS 3.0 is 8.8 with low attack complexity, adjacent-network attack vector, no privileges, and no user interaction. The source bundle identifies fixed-version thresholds per model but does not provide deeper root-cause or exploit mechanics.
Likely exposure
Exposure is limited to listed NETGEAR models running firmware below the named fixed versions: D3600/D6000/D6200/D7000, JR6150, PR2000, R6020/R6050/R6080/R6120/R6220/R6260/R6700v2/R6800/R6900v2, WNR2020, and XR500. The sources do not establish internet exposure.
Exploitation context
The CVE says exploitation is unauthenticated and pre-authentication. The CVSS vector requires adjacent network access, not general remote internet access. The source bundle marks KEV as false and provides no cited evidence of active exploitation.
Researcher notes
The public bundle lacks CWE mapping, detailed vulnerable component information, and proof-of-exploit status. Focus validation on model/version matching and vendor advisory alignment. Avoid assuming broader NETGEAR product impact beyond the named devices.
Mitigation direction
- Inventory listed NETGEAR models and record their exact firmware versions.
- Upgrade each affected model to at least the fixed version named in the advisory.
- Check NETGEAR guidance for any model-specific firmware or support limitations.
- Retire devices that cannot run a non-affected firmware version.
- Limit untrusted adjacent network access to management and router-facing services.
Validation and detection
- Compare device model and firmware against the CVE fixed-version thresholds.
- Confirm upgrades through the device UI or centralized inventory records.
- Review network segmentation around affected routers and gateways.
- Check vendor release notes or advisory status for the exact model.
- Document unsupported or unpatched devices as accepted or remediated risk.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-20684 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000061455/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2018-0297CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.