← Vulnerability feed

Vulnerability record · CVE-2019-20646 · published 15 April 2020

CVE-2019-20646: Netgear rax40 firmware information exposure vulnerability

Netgear · Rax40 Firmware

NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of administrative credentials.

9.8 CVSS 3.1 Critical EPSS 1.3% · top 30.4% CWE-200 · Information exposure
9.8CVSS 3.1 base score, v2 5.0
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of administrative credentials.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kb.netgear.com/000061496/Security-Advisory-for-Admin-Credential-Disclosure-on-RAX40-PSV-2019-0237 Vendor Advisory
https://kb.netgear.com/000061496/Security-Advisory-for-Admin-Credential-Disclosure-on-RAX40-PSV-2019-0237 Vendor Advisory

Track CVE-2019-20646 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-48196Netgear rax40 firmware classic buffer overflow vulnerabilityCertain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX40 before 1.0.2.60, RAX35 before 1.0.2.60, …EPSS 0.94%9.4CVE-2020-35800Netgear ac2100 firmware vulnerabilityCertain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC…EPSS 1.6%8.8CVE-2023-27358Netgear rax30 firmware sql injection vulnerabilityNETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitra…EPSS 0.88%8.8CVE-2022-27645Netgear lax20 firmware missing authentication for critical function vulnerabilityThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is…EPSS 1.3%8.8CVE-2022-27642Netgear cax80 firmware incorrect authorization vulnerabilityThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers.…EPSS 0.87%8.8CVE-2020-26898Netgear rax40 firmware vulnerabilityNETGEAR RAX40 devices before 1.0.3.80 are affected by incorrect configuration of security settings.EPSS 0.60%8.8CVE-2019-20641Netgear rax40 firmware vulnerabilityNETGEAR RAX40 devices before 1.0.3.64 are affected by lack of access control at the function level.EPSS 0.83%8.0CVE-2022-27647Netgear cax80 firmware os command injection vulnerabilityThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2019-20646), CISA KEV, FIRST EPSS (scores of 2026-10-14). This page is refreshed as NVD updates the record.