CVE-2019-20489

CVE-2019-20489 describes an authentication bypass vulnerability in the web management interface (setup.cgi) of NETGEAR WNR1000V4 1.1.0.54 devices. An attacker can exploit this by sending a specific request without a cookie, then reusing the Set-Cookie header from the 401 Unauthorized response to gain unauthorized access. This critical vulnerability (CVSS 9.8) allows for remote compromise of the device, leading to high impacts on confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.