Lucene search

[email protected]CVE-2022-47208

HistoryDec 16, 2022 - 8:15 p.m.

CVE-2022-47208

2022-12-1620:15:08

CWE-78

[email protected]

web.nvd.nist.gov

cve-2022-47208

puhttpsniff

command injection

network security

nvd

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.

Affected configurations

NVD

Node

netgearnighthawk_ax1800Match-

AND

netgearnighthawk_ax1800_firmwareRange<1.0.9.90

Node

netgearnighthawk_ax2400Match-

AND

netgearnighthawk_ax2400_firmwareRange<1.0.9.90

Node

netgearnighthawk_ax3000Match-

AND

netgearnighthawk_ax3000_firmwareRange<1.0.9.90

Node

netgearnighthawk_ax5400Match-

AND

netgearnighthawk_ax5400_firmwareRange<1.0.9.90

Node

netgearnighthawk_ax6000Match-

AND

netgearnighthawk_ax6000_firmwareRange<1.0.9.90

Node

netgearnighthawk_ax11000Match-

AND

netgearnighthawk_ax11000_firmwareRange<1.0.9.90

CPENameOperatorVersion
netgear:nighthawk_ax1800_firmwarenetgear nighthawk ax1800 firmwarelt1.0.9.90

CPE	Name	Operator	Version
netgear:nighthawk_ax1800_firmware	netgear nighthawk ax1800 firmware	lt	1.0.9.90

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "NETGEAR Nighthawk WiFi6 Router",
    "versions": [
      {
        "version": "NETGEAR Nighthawk WiFi6 Router prior to V1.0.9.90",
        "status": "affected"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2022-37

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

Related for CVE-2022-47208

cvelist1 prion1 nvd1