Lucene search

[email protected]NVD:CVE-2022-27647

HistoryMar 29, 2023 - 7:15 p.m.

CVE-2022-27647

2023-03-2919:15:08

CWE-78

[email protected]

web.nvd.nist.gov

netgear

vulnerability

arbitrary code execution

system call

authentication bypass

8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

18.2%

JSON

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the name or email field provided to libreadycloud.so. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15874.

Affected configurations

NVD

Node

netgearcax80_firmwareRange<2.1.3.7

AND

netgearcax80Match-

Node

netgearlax20_firmwareRange<1.1.6.34

AND

netgearlax20Match-

Node

netgearmr60_firmwareRange<1.1.6.124

AND

netgearmr60Match-

Node

netgearmr80_firmwareRange<1.1.6.14

AND

netgearmr80Match-

Node

netgearms60_firmwareRange<1.1.6.124

AND

netgearms60Match-

Node

netgearms80_firmwareRange<1.1.6.14

AND

netgearms80Match-

Node

netgearr6400_firmwareRange<1.0.1.78

AND

netgearr6400Match-

Node

netgearr6400_firmwareRange<1.0.4.126

AND

netgearr6400Matchv2

Node

netgearr6700_firmwareRange<1.0.4.126

AND

netgearr6700Matchv3

Node

netgearr6900p_firmwareRange<1.3.3.148

AND

netgearr6900pMatch-

Node

netgearr7000_firmwareRange<1.0.11.134

AND

netgearr7000Match-

Node

netgearr7000p_firmwareRange<1.3.3.148

AND

netgearr7000pMatch-

Node

netgearr7850_firmwareRange<1.0.5.84

AND

netgearr7850Match-

Node

netgearr7900p_firmwareRange<1.4.3.88

AND

netgearr7900pMatch-

Node

netgearr7960p_firmwareRange<1.4.3.88

AND

netgearr7960pMatch-

Node

netgearr8000_firmwareRange<1.0.4.84

AND

netgearr8000Match-

Node

netgearr8000p_firmwareRange<1.4.3.88

AND

netgearr8000pMatch-

Node

netgearr8500_firmwareRange<1.0.2.158

AND

netgearr8500Match-

Node

netgearrax15_firmwareRange<1.0.10.110

AND

netgearrax15Match-

Node

netgearrax20_firmwareRange<1.0.10.110

AND

netgearrax20Match-

Node

netgearrax200_firmwareRange<1.0.6.138

AND

netgearrax200Match-

Node

netgearrax35_firmwareRange<1.0.10.110

AND

netgearrax35Matchv2

Node

netgearrax38_firmwareRange<1.0.10.110

AND

netgearrax38Matchv2

Node

netgearrax40_firmwareRange<1.0.10.110

AND

netgearrax40Matchv2

Node

netgearrax42_firmwareRange<1.0.10.110

AND

netgearrax42Match-

Node

netgearrax43_firmwareRange<1.0.10.110

AND

netgearrax43Match-

Node

netgearrax45_firmwareRange<1.0.10.110

AND

netgearrax45Match-

Node

netgearrax48_firmwareRange<1.0.10.110

AND

netgearrax48Match-

Node

netgearrax50_firmwareRange<1.0.10.110

AND

netgearrax50Match-

Node

netgearrax50s_firmwareRange<1.0.10.110

AND

netgearrax50sMatch-

Node

netgearrax75_firmwareRange<1.0.6.138

AND

netgearrax75Match-

Node

netgearrax80_firmwareRange<1.0.6.138

AND

netgearrax80Match-

Node

netgearrs400_firmwareRange<1.5.1.86

AND

netgearrs400Match-

Node

netgearr7100lg_firmwareRange<1.0.0.76

AND

netgearr7100lgMatch-

References

kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327

www.zerodayinitiative.com/advisories/ZDI-22-524/

8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

18.2%

JSON

Related for NVD:CVE-2022-27647

prion1 cvelist1 zdi1 cve1