CVE-2022-27645
Summary
| CVE | CVE-2022-27645 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-03-29 19:15:00 UTC |
| Updated | 2023-04-28 21:15:00 UTC |
| Description | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloud_control.cgi. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15762. |
Risk And Classification
Problem Types: CWE-306
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Netgear | Lax20 | - | All | All | All |
| Operating System | Netgear | Lax20 Firmware | All | All | All | All |
| Hardware | Netgear | R6400 | v2 | All | All | All |
| Operating System | Netgear | R6400 Firmware | All | All | All | All |
| Hardware | Netgear | R6700 | v3 | All | All | All |
| Operating System | Netgear | R6700 Firmware | All | All | All | All |
| Hardware | Netgear | R7000 | - | All | All | All |
| Operating System | Netgear | R7000 Firmware | All | All | All | All |
| Hardware | Netgear | R7850 | - | All | All | All |
| Operating System | Netgear | R7850 Firmware | All | All | All | All |
| Hardware | Netgear | R7900p | - | All | All | All |
| Operating System | Netgear | R7900p Firmware | All | All | All | All |
| Hardware | Netgear | R7960p | - | All | All | All |
| Operating System | Netgear | R7960p Firmware | All | All | All | All |
| Hardware | Netgear | R8000 | - | All | All | All |
| Hardware | Netgear | R8000p | - | All | All | All |
| Operating System | Netgear | R8000p Firmware | All | All | All | All |
| Operating System | Netgear | R8000 Firmware | All | All | All | All |
| Hardware | Netgear | R8500 | - | All | All | All |
| Operating System | Netgear | R8500 Firmware | All | All | All | All |
| Hardware | Netgear | Rax15 | - | All | All | All |
| Operating System | Netgear | Rax15 Firmware | All | All | All | All |
| Hardware | Netgear | Rax20 | - | All | All | All |
| Hardware | Netgear | Rax200 | - | All | All | All |
| Operating System | Netgear | Rax200 Firmware | All | All | All | All |
| Operating System | Netgear | Rax20 Firmware | All | All | All | All |
| Hardware | Netgear | Rax35 | v2 | All | All | All |
| Operating System | Netgear | Rax35 Firmware | All | All | All | All |
| Hardware | Netgear | Rax38 | v2 | All | All | All |
| Operating System | Netgear | Rax38 Firmware | All | All | All | All |
| Hardware | Netgear | Rax40 | v2 | All | All | All |
| Operating System | Netgear | Rax40 Firmware | All | All | All | All |
| Hardware | Netgear | Rax42 | - | All | All | All |
| Operating System | Netgear | Rax42 Firmware | All | All | All | All |
| Hardware | Netgear | Rax43 | - | All | All | All |
| Operating System | Netgear | Rax43 Firmware | All | All | All | All |
| Hardware | Netgear | Rax45 | - | All | All | All |
| Operating System | Netgear | Rax45 Firmware | All | All | All | All |
| Hardware | Netgear | Rax48 | - | All | All | All |
| Operating System | Netgear | Rax48 Firmware | All | All | All | All |
| Hardware | Netgear | Rax50 | - | All | All | All |
| Hardware | Netgear | Rax50s | - | All | All | All |
| Operating System | Netgear | Rax50s Firmware | All | All | All | All |
| Operating System | Netgear | Rax50 Firmware | All | All | All | All |
| Hardware | Netgear | Rax75 | - | All | All | All |
| Operating System | Netgear | Rax75 Firmware | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Advisory for Sensitive Information Disclosure on Some Routers and Fixed Wireless Products, PSV-2021-0325 | Answer | NETGEAR Support | MISC | kb.netgear.com | |
| ZDI-22-522 | Zero Day Initiative | MISC | www.zerodayinitiative.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.