Is CVE-2019-20685 actively exploited?

No active exploitation of CVE-2019-20685 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-20685 be exploited remotely?

Partially. CVE-2019-20685 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2019-20685?

CVE-2019-20685 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2019-20685

HIGH

CVE-2019-20685

CWE-787Published: April 16, 2020· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D6200 before 1.1.00.32, D7000 before 1.0.1.68, DM200 before 1.0.0.58, JR6150 before 1.0.1.18, PR2000 before 1.0.0.28, R6020 before 1.0.0.38, R6050 before 1.0.1.18, R6080 before 1.0.0.38, R6120 before 1.0.0.46, R6220 before 1.1.0.80, R6260 before 1.1.0.40, R6700v2 before 1.2.0.36, R6800 before 1.2.0.36, R6900v2 before 1.2.0.36, WNR2020 before 1.1.0.62, and XR500 before 2.3.2.32.

NVD Source

Technical Analysis

CVE-2019-20685 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.