{"id":"CVE-2020-14432","aliases":["EUVD-2020-6571","GHSA-v4q2-mprg-284p","MGASA-2020-0363"],"status":"published","title":"Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before...","description":"Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.","severity":{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00445,"percentile":0.38912,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2020-06-18T16:33:29Z","modified":"2026-06-17T02:54:45Z","affected":[{"source":"osv","ecosystem":"Mageia:7","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1.1.mga7"}]}],"bundled":3}],"products":[{"vendor":"netgear","product":"rbk752_firmware"},{"vendor":"netgear","product":"rbk753_firmware"},{"vendor":"netgear","product":"rbk753s_firmware"},{"vendor":"netgear","product":"rbk842_firmware"},{"vendor":"netgear","product":"rbk852_firmware"},{"vendor":"netgear","product":"rbk853_firmware"},{"vendor":"netgear","product":"rbr750_firmware"},{"vendor":"netgear","product":"rbr840_firmware"},{"vendor":"netgear","product":"rbr850_firmware"},{"vendor":"netgear","product":"rbs750_firmware"},{"vendor":"netgear","product":"rbs840_firmware"},{"vendor":"netgear","product":"rbs850_firmware"}],"references":[{"url":"https://kb.netgear.com/000061937/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-WiFi-Systems-PSV-2020-0049","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14432"},{"url":"https://github.com/advisories/GHSA-v4q2-mprg-284p"},{"url":"https://advisories.mageia.org/MGASA-2020-0363.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27175","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3600","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-14432","description":"Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.","status":"published","published":"2020-06-18T16:33:29Z","modified":"2024-08-04T12:46:34.433Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6571","description":"Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.","status":"published","published":"2020-06-18T16:33:29Z","modified":"2024-08-04T12:46:34Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N","level":"high"}],"updated_at":"2026-11-03T03:07:34.099541Z"}],"ghsa":[{"id":"GHSA-v4q2-mprg-284p","title":"Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before...","description":"Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.","status":"published","published":"2022-05-24T17:20:54Z","modified":"2023-01-29T05:03:04Z","updated_at":"2026-11-02T14:45:14.198561Z"}],"nvd":[{"id":"CVE-2020-14432","description":"Certain NETGEAR devices are affected by CSRF. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.","status":"published","published":"2020-06-18T17:15:12.327Z","modified":"2026-06-17T02:54:45.537Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:06:07.249892Z"}],"osv":[{"id":"MGASA-2020-0363","title":"Updated ansible package fixes security vulnerabilities","description":"An Improper Output Neutralization for Logs flaw was found in Ansible when using\nthe uri module, where sensitive data is exposed to content and json output.\nThis flaw allows an attacker to access the logs or outputs of performed tasks\nto read keys used in playbooks from other users within the uri module. The\nhighest threat from this vulnerability is to data confidentiality\n(CVE-2020-14430).\n\nA flaw was found in the Ansible Engine when using module_args. Tasks executed\nwith check mode (--check-mode) do not properly neutralize sensitive data\nexposed in the event data. This flaw allows unauthorized users to read this\ndata. The highest threat from this vulnerability is to confidentiality\n(CVE-2020-14432).\n\nA flaw was found in the Ansible Engine when installing packages using the dnf\nmodule. GPG signatures are ignored during installation even when\ndisable_gpg_check is set to False, which is the default behavior. This flaw\nleads to malicious packages being installed on the system and arbitrary code\nexecuted via package installation scripts. The highest threat from this\nvulnerability is to integrity and system availability (CVE-2020-14365).\n","status":"published","published":"2020-09-05T09:34:29Z","modified":"2026-04-16T04:40:59.734119009Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}