Certain NETGEAR devices are affected by reflected XSS.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netgear jnr1010 firmwarebefore 1.1.0.46
• netgear jr6150 firmwarebefore 1.0.1.10
• netgear jwnr2010 firmwarebefore 1.1.0.46
• netgear pr2000 firmwarebefore 1.0.0.20
• netgear r6050 firmwarebefore 1.0.1.10
• netgear r6220 firmwarebefore 1.1.0.60
• netgear wndr3700 firmwarebefore 1.1.0.50
• netgear wnr1000 firmwarebefore 1.1.0.46
• netgear wnr2020 firmwarebefore 1.1.0.46
• netgear wnr2050 firmwarebefore 1.1.0.46

Other highest-scoring records for the same primary product.

• CVE-2016-11014NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.
  40Plan
• CVE-2017-18737Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
  36Monitor
• CVE-2017-18734Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
  36Monitor
• CVE-2018-21226Certain NETGEAR devices are affected by authentication bypass.
  35Monitor
• CVE-2017-18749Certain NETGEAR devices are affected by CSRF.
  35Monitor
• CVE-2016-11057Certain NETGEAR devices are affected by mishandling of repeated URL calls.
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1commentEl.innerHTML = comment.body;

1commentEl.textContent = comment.body;

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.