CVE-2020-26919
Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability
Description
CVE-2020-26919 is a critical-severity missing function level access control vulnerability affecting NETGEAR JGS516PE managed switch devices. The lack of proper access control at the function level allows unauthenticated remote attackers to gain full administrative control over the device, potentially compromising the entire network segment managed by the switch. CISA has added CVE-2020-26919 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 94.2% (99.9th percentile), this vulnerability has one of the highest exploitation probabilities in the entire vulnerability ecosystem.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| netgear | jgs516pe firmware | < 2.6.0.43 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
The NVD has not assigned a specific CWE to CVE-2020-26919. The vulnerability is characterized as a missing function level access control issue, where administrative functions on the NETGEAR JGS516PE are accessible without proper authentication or authorization checks. This allows unauthenticated attackers to invoke privileged management operations that should be restricted to authorized administrators only.
Impact Analysis
CVE-2020-26919 carries a CVSS 3.1 score of 9.8 (CRITICAL), the near-maximum severity rating, reflecting an extremely dangerous vulnerability. The vulnerability is exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivially exploitable by any attacker with network access to the device. Confidentiality (High): An attacker can read all configuration data on the switch, including VLAN configurations, access control lists, SNMP community strings, and potentially credentials for other network devices. Integrity (High): Full administrative access enables modification of switch configurations, port mirroring for traffic interception, VLAN manipulation, and firmware tampering. Availability (High): An attacker can disrupt network connectivity by reconfiguring or disabling the switch, causing a denial of service across all connected network segments. The EPSS score of 94.2% places this in the 99.9th percentile, indicating near-certain exploitation.
Exploit Maturity
CVE-2020-26919 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 94.2% (99.9th percentile) indicates near-certain exploitation activity, placing this among the most exploited vulnerabilities tracked globally. The combination of critical severity (CVSS 9.8), trivial exploitability (no authentication required, low complexity, network-accessible), and the high value of network infrastructure devices as attack targets makes this vulnerability extremely attractive to threat actors. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Update NETGEAR JGS516PE firmware to version 2.6.0.43 or later, which addresses the missing access control vulnerability.
- Verify the firmware version on all deployed JGS516PE devices by accessing the device management interface and confirming the installed firmware matches or exceeds version 2.6.0.43.
- If immediate firmware update is not possible, isolate affected JGS516PE devices by placing them on a restricted management VLAN with strict firewall rules that limit access to the device's management interface to authorized IP addresses only.
- Monitor network traffic to and from JGS516PE devices for unauthorized management access attempts, configuration changes, or unusual traffic patterns that may indicate exploitation. Enable logging on the devices and forward logs to a centralized SIEM for analysis.
- Conduct a comprehensive review of the switch configuration to identify any unauthorized changes that may have been made through the missing access control, including unexpected port mirroring rules, VLAN modifications, ACL changes, or firmware alterations.
Technical Details
CVE-2020-26919 affects NETGEAR JGS516PE 16-port Gigabit Ethernet PoE Smart Managed Plus Switch devices running firmware versions prior to 2.6.0.43. The vulnerability stems from a fundamental lack of access control at the function level, meaning that administrative management functions exposed by the device's network interface can be invoked without any authentication or authorization verification. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case exploitability scenario: network-accessible, low complexity, no privileges needed, and no user interaction required. This means any device on the network that can reach the switch's management interface can perform administrative operations, including reading and modifying the full device configuration, without presenting any credentials. The critical 9.8 CVSS score accurately represents the combination of trivial exploitation and maximum impact across all three security dimensions.
Frequently Asked Questions
Is CVE-2020-26919 being actively exploited?
Yes. CVE-2020-26919 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.2% (99.9th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted vulnerabilities.
What products are affected by CVE-2020-26919?
CVE-2020-26919 affects NETGEAR JGS516PE 16-port Gigabit Ethernet PoE Smart Managed Plus Switch devices running firmware versions prior to 2.6.0.43. Organizations should audit their network infrastructure for any deployed instances of this switch model.
How do I fix CVE-2020-26919?
Update the NETGEAR JGS516PE firmware to version 2.6.0.43 or later. If immediate patching is not possible, isolate the device on a restricted management VLAN and limit management interface access to authorized IP addresses only.
How severe is CVE-2020-26919?
CVE-2020-26919 has a CVSS 3.1 score of 9.8 (CRITICAL). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable with maximum impact on confidentiality, integrity, and availability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.