CVE-2019-20489

An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FW_remote.htm&todo=cfg_init request without a cookie, reads the Set-Cookie header in the 401 Unauthorized response, and then repeats the FW_remote.htm&todo=cfg_init request with the specified cookie.

• CWE-287

• https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/Third Party Advisory
• https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2019/august/the-netgear-wnr1000v4-round-2/Third Party Advisory

Published

Mar 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20483An issue was discovered in Viki Vera 4.9.1.26180. An attacke…5.4
• CVE-2019-20484An issue was discovered in Viki Vera 4.9.1.26180. A user wit…8.1
• CVE-2019-20485qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the ho…5.7
• CVE-2019-20486An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 device…6.1
• CVE-2019-20487An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 device…8.8
• CVE-2019-20488An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 device…9.8
• CVE-2019-2049In SendMediaUpdate and SendFolderUpdate of avrcp_service.cc,…
• CVE-2019-20490cPanel before 82.0.18 allows authentication bypass because w…8.8
• CVE-2019-20491cPanel before 82.0.18 allows attackers to leverage virtual m…5.4
• CVE-2019-20492cPanel before 82.0.18 allows authentication bypass because o…8.8
• CVE-2019-20493cPanel before 82.0.18 allows self-XSS because JSON string es…6.1
• CVE-2019-20494In cPanel before 82.0.18, Cpanel::Rand::Get can produce a pr…3.3