{"id":"CVE-2020-26919","kind":"vulnerability","aliases":["CVE-2020-26919"],"related":[],"title":"NETGEAR JGS516PE Devices: Netgear JGS516PE Devices Missing Function Level Access Control Vulnerability","description":"Netgear JGS516PE devices contain a missing function level access control vulnerability.\n\nCISA required action: Apply updates per vendor instructions.","summary":"NETGEAR JGS516PE network switches are missing function-level access control, so some functions can be reached without the proper authorization check. An attacker who reaches the device may be able to perform actions they should not be allowed to perform.","severity":"critical","cvss":9.8,"epss":0.57468,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"NETGEAR JGS516PE Devices","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","jgs516pe","netgear","network-switch"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply updates per vendor instructions (CISA KEV required action); the fixed firmware version is unknown from the sources.","status":"open","published_at":"2020-10-09T07:15:17+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:41:35+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:41:35Z","model":"claude-haiku-5-5","output":{"fix":"Apply updates per vendor instructions (CISA KEV required action); the fixed firmware version is unknown from the sources.","reach":"unknown","impact":"medium","summary":"NETGEAR JGS516PE network switches are missing function-level access control, so some functions can be reached without the proper authorization check. An attacker who reaches the device may be able to perform actions they should not be allowed to perform.","category":"infrastructure","who_cares":["netgear","jgs516pe","network-switch"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker performs unauthorized device functions on the switch without proper access checks.","analyst_note":"Confirm affected and fixed firmware versions and the vulnerable function/endpoint from the NETGEAR advisory and the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000459,"input_tokens":2827,"output_tokens":352,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Confirm affected and fixed firmware versions and the vulnerable function/endpoint from the NETGEAR advisory and the CISA KEV entry.","search":"'-2020':14A,17A '-26919':15A,18A 'abl':59B 'access':10A,38B,78C 'action':62B,83C 'allow':67B 'appli':84C 'attack':52B 'author':49B 'check':50B 'cisa':81C 'contain':73C 'control':11A,39B,79C 'cve':13A,16A 'devic':3A,6A,56B,72C 'devices':21A 'exploit':22B 'function':8A,36B,42B,76C 'function-level':35B 'infrastructur':23B 'instruct':88C 'jgs516pe':2A,5A,20A,24B,30B,71C 'level':9A,37B,77C 'may':57B 'miss':7A,34B,75C 'netgear':1A,4A,19A,25B,29B,70C 'network':27B,31B 'network-switch':26B 'per':86C 'perform':61B,69B 'proper':48B 'reach':45B,54B 'requir':82C 'switch':28B,32B 'updat':85C 'vendor':87C 'vulner':12A,80C 'without':46B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-10-09T07:15:17+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-26919","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-26919","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:44+00:00","note":null},{"source":"epss","external_id":"CVE-2020-26919","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-26919","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-26919","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26919","severity":null,"published_at":"2020-10-09T07:15:17+00:00","modified_at":"2026-06-17T03:08:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T21:57:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}