CVE-2022-27647

CWE: Command injection in NETGEAR R6700v3 router (CVE-2022-27647). The flaw resides in libreadycloud.so handling of user-supplied name/email, enabling root code execution via system calls after bypassing authentication. Documented by ZDI-22-524 (RCE via remote attacker with ADJACENT access) and m...

CVE-2022-27646

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

CVE-2022-27647

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists...

CVE-2022-27643

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the...

CVE-2022-27644

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files...

CVE-2022-27642

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect...

CVE-2022-27641

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB module. The issue results from the lack of...

CVE-2022-27645

CVE-2022-27645 affects NETGEAR R6700v3 routers. The flaw in readycloud_control.cgi allows network-adjacent attackers to bypass authentication, gaining code execution in the root context. Impact is high (C/H/I/A). Sources note this is tied to ZDI-15762; no explicit fix/version is provided in the c...

CVE-2022-27643

CVE-2022-27643 affects NETGEAR R6700v3 routers; a pre-auth buffer overflow in upnpd when parsing the SOAPAction header allows network-adjacent attackers to execute code with root privileges. Investigations reference ZDI-CAN-15692 and multiple security trackers noting a SOAP handling flaw. The con...

CVE-2022-27642

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect...

CVE-2022-27643

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the...

CVE-2022-27642

Summary (CVE-2022-27642) : Affects NETGEAR R6700v3 router with firmware 1.0.4.120_10.0.91. The vulnerability is in the httpd service and stems from incorrect string matching logic when accessing protected pages, allowing network-adjacent attackers to bypass authentication. In combination with oth...

CVE-2022-27644

The CVE-2022-27644 issue affects NETGEAR R6700v3 routers (version 1.0.4.120_10.0.91). The root cause is failure to properly validate the server certificate during HTTPS-based file downloads, allowing network-adjacent attackers to compromise the integrity of downloaded information. The vulnerabili...

CVE-2022-27641

Summary (CVE-2022-27641): Affected: NETGEAR R6700v3 with firmware 1.0.4.120 10.0.91. Component: NetUSB module. Cause: improper validation of user-supplied data leading to an integer overflow during buffer allocation. Impact: remote code execution in the context of root by network-adjacent attacke...

The vulnerability of the crypt_64bit_up/down() function in the Telnet service of Netgear’s microprogrammed router Orbi RBR750 allows a hacker to execute arbitrary commands.

The vulnerability of the crypt64bitup/down function in the Telnet service of Netgear Orbi RBR750 microprogramming routers is related to the presence of hidden functionality when using the Blowfish cryptographic algorithm. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability of the access control function in Netgear Orbi RBR750 software allows a hacker to execute arbitrary code.

The vulnerability of the access control function of Netgear Orbi RBR750 software exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a speciall...

NETGEAR RBR750 dev_name Parameter Command Injection Vulnerability

The NETGEAR RBR750 is a home WiFi system from NETGEAR. The NETGEAR RBR750 version 4.6.8.5 suffers from a command injection vulnerability that stems from the devname parameter failing to properly filter constructed command special characters, commands, and so on. An attacker could exploit this...

NETGEAR Orbi Satellite RBS750 ubus backend communication function command execution vulnerability

The NETGEAR Orbi Satellite RBS750 is a professional-grade tri-band satellite router from NETGEAR. The NETGEAR Orbi Satellite RBS750 suffers from a command execution vulnerability that stems from a failure to properly filter constructed command special characters, commands, etc. in the ubus back-e...

NETGEAR RBR750 Command Injection Vulnerability

The NETGEAR RBR750 is a home WiFi system from NETGEAR. The NETGEAR RBR750 version 4.6.8.5 suffers from a command injection vulnerability that stems from a failure to properly filter constructed command special characters, commands, etc. in the hidden telnet service feature. An attacker could...

NETGEAR RBR750 Information Disclosure Vulnerability

The NETGEAR RBR750 is a home WiFi system from NETGEAR. An information disclosure vulnerability exists in the NETGEAR RBR750 version 4.6.8.5, which originates from a plaintext transmission in the remote management function. An attacker could exploit the vulnerability to obtain sensitive informatio...