Security readout for executives and security teams
Plain-English summary
This flaw lets someone who can observe relevant network traffic reuse a NETGEAR switch authentication token until a new token is generated. If successful, they can effectively gain administrative privileges on affected JGS516PE/GS116Ev2 devices running v2.6.0.43.
Executive priority
Treat this as a high-priority network infrastructure issue where affected devices are present. The main business risk is unauthorized administrative control of access switches, but evidence for internet-scale exploitation is not provided.
Technical view
CVE-2020-35229 concerns improper invalidation of the authentication token used for NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43. The source states token reuse can permit administrative privilege when an attacker has access to network traffic.
Likely exposure
Exposure is likely limited to environments with affected NETGEAR JGS516PE or GS116Ev2 switches on firmware v2.6.0.43, especially where management or NSDP-related traffic can be observed by non-administrators.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The attack condition is meaningful network-traffic access; the public description does not provide exploit prevalence or confirmed exploitation.
Researcher notes
The source bundle lacks CVSS, CWE, and detailed vendor fix information. Analysis is based on the CVE description and NCC Group advisory reference. Do not assume other firmware versions or NETGEAR products are affected without vendor evidence.
Mitigation direction
- Inventory NETGEAR JGS516PE and GS116Ev2 switches and identify firmware v2.6.0.43.
- Check NETGEAR and NCC Group guidance for vendor-confirmed remediation.
- Restrict switch management traffic to trusted administrative networks.
- Reduce opportunities for untrusted users to observe management-plane traffic.
- Prioritize replacement or isolation if vendor guidance is unavailable.
Validation and detection
- Confirm whether JGS516PE or GS116Ev2 devices exist in the environment.
- Record firmware versions and flag v2.6.0.43 for review.
- Map who can observe or access switch management traffic.
- Check whether compensating network segmentation is in place.
- Document vendor remediation status before closing the finding.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-35229 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.