Information disclosure in NETGEAR products - CVE-2022-27647

Vulnerability identifier: #VU61588

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27647

CWE-ID: CWE-200

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker with access to the local network or WiFi can gain unauthorized access to sensitive information on the system.

R7100LG
R6400
R8500
R6400v2
R7000
R7000P
R6900P
RS400
R6700v3
RAX48
RAX45
RAX43
RAX42
RAX40v2
RAX38v2
RAX35v2
RAX20
RAX15
RAX50
RAX50S
MS80
MR80
LAX20
CAX80

Install updates from vendor's website.

R7100LG - update to 1.0.0.76
R6400 - update to 1.0.1.78
R8500 - update to 1.0.2.158
R6400v2 - update to 1.0.4.126
R6700v3 - update to 1.0.4.126
RAX48 - update to 1.0.10.110
RAX45 - update to 1.0.10.110
RAX43 - update to 1.0.10.110
RAX42 - update to 1.0.10.110
RAX40v2 - update to 1.0.10.110
RAX38v2 - update to 1.0.10.110
RAX35v2 - update to 1.0.10.110
RAX20 - update to 1.0.10.110
RAX15 - update to 1.0.10.110
RAX50 - update to 1.0.10.110
RAX50S - update to 1.0.10.110
R7000 - update to 1.0.11.134
MS80 - update to 1.1.6.14
MR80 - update to 1.1.6.14
LAX20 - update to 1.1.6.34
R7000P - update to 1.3.3.148
R6900P - update to 1.3.3.148
RS400 - update to 1.5.1.86
CAX80 - update to 2.1.3.7

• https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327

• Multiple vulnerabilities in NETGEAR Products