What’s Vulnerable › Vulnerabilities

CVE-2020-14435

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-18 · updated 2026-06-17
• Weakness: CWE-77

Description

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.2.104, SRS60 before 2.5.2.104, SRR60 before 2.5.2.104, SRK60B03 before 2.5.2.104, SRK60B04 before 2.5.2.104, SRK60B05 before 2.5.2.104, and SRK60B06 before 2.5.2.104.

Affected products

• NETGEAR Srk60 Firmware: before 2.5.2.104 — fixed in 2.5.2.104
• NETGEAR Srk60B03 Firmware: before 2.5.2.104 — fixed in 2.5.2.104
• NETGEAR Srk60B04 Firmware: before 2.5.2.104 — fixed in 2.5.2.104
• NETGEAR Srk60B05 Firmware: before 2.5.2.104 — fixed in 2.5.2.104
• NETGEAR Srk60B06 Firmware: before 2.5.2.104 — fixed in 2.5.2.104
• NETGEAR Srr60 Firmware: before 2.5.2.104 — fixed in 2.5.2.104
• NETGEAR Srs60 Firmware: before 2.5.2.104 — fixed in 2.5.2.104

How to fix

Upgrade to a fixed version: NETGEAR Srk60 Firmware 2.5.2.104; NETGEAR Srk60B03 Firmware 2.5.2.104; NETGEAR Srk60B04 Firmware 2.5.2.104; NETGEAR Srk60B05 Firmware 2.5.2.104; NETGEAR Srk60B06 Firmware 2.5.2.104; NETGEAR Srr60 Firmware 2.5.2.104; NETGEAR Srs60 Firmware 2.5.2.104. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000061930/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0026
• https://kb.netgear.com/000061930/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0026

Get alerted when CVE-2020-14435 or the next vulnerability affects your stack