CVE-2022-27641
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
32.9%
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15806.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| netgear | d7800_firmware | * | cpe:2.3:o:netgear:d7800_firmware:*:*:*:*:*:*:*:* |
| netgear | d7800 | - | cpe:2.3:h:netgear:d7800:-:*:*:*:*:*:*:* |
| netgear | ex6200_firmware | * | cpe:2.3:o:netgear:ex6200_firmware:*:*:*:*:*:*:*:* |
| netgear | ex6200 | v2 | cpe:2.3:h:netgear:ex6200:v2:*:*:*:*:*:*:* |
| netgear | ex8000_firmware | * | cpe:2.3:o:netgear:ex8000_firmware:*:*:*:*:*:*:*:* |
| netgear | ex8000 | - | cpe:2.3:h:netgear:ex8000:-:*:*:*:*:*:*:* |
| netgear | r6220_firmware | * | cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:* |
| netgear | r6220 | - | cpe:2.3:h:netgear:r6220:-:*:*:*:*:*:*:* |
| netgear | r6230_firmware | * | cpe:2.3:o:netgear:r6230_firmware:*:*:*:*:*:*:*:* |
| netgear | r6230 | - | cpe:2.3:h:netgear:r6230:-:*:*:*:*:*:*:* |
Related
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
32.9%