Is CVE-2019-20752 actively exploited?

No active exploitation of CVE-2019-20752 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-20752 be exploited remotely?

Yes. CVE-2019-20752 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-20752?

CVE-2019-20752 has a CVSS score of 4.8 (MEDIUM).

HOME VULNERABILITIESCVE-2019-20752

MEDIUM

CVE-2019-20752

CWE-79Published: April 16, 2020· Updated: Jun 17, 2026

4.8

CVSS v3.1

Official Description

Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.75, D6000 before 1.0.0.75, D7800 before 1.0.1.44, DM200 before 1.0.0.58, R7800 before 1.0.2.58, R8900 before 1.0.4.12, R9000 before 1.0.4.12, RBK20 before 2.3.0.28, RBR20 before 2.3.0.28, RBS20 before 2.3.0.28, RBK40 before 2.3.0.28, RBS40 before 2.3.0.28, RBK50 before 2.3.0.32, RBR50 before 2.3.0.32, RBS50 before 2.3.0.32, WN3000RPv2 before 1.0.0.68, WN3000RPv3 before 1.0.2.70, WN3100RPv2 before 1.0.0.60, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, and WNR2000v5 before 1.0.0.68.

NVD Source

Technical Analysis

CVE-2019-20752 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.