CVE-2022-47208

2022-12-1600:00:00

tenable

www.cve.org

puhttpsniff service

command injection

unauthenticated attacker

network segment

arbitrary commands

authentication

AI Score

9.5

Confidence

High

EPSS

Percentile

14.2%

JSON

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "NETGEAR Nighthawk WiFi6 Router",
    "versions": [
      {
        "version": "NETGEAR Nighthawk WiFi6 Router prior to V1.0.9.90",
        "status": "affected"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2022-37