Improper Authentication in NETGEAR products - CVE-2022-27644

Vulnerability identifier: #VU61589

CSH Severity: Low

CVSS v4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27644

CWE-ID: CWE-287

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. An attacker with physical access can bypass authentication process and gain unauthorized access to the application.

R6400v2
R7000
R6900P
R7000P
RS400
R6700v3
CBR40

Install updates from vendor's website.

R6400v2 - update to 1.0.4.126
R6700v3 - update to 1.0.4.126
R7000 - update to 1.0.11.134
R6900P - update to 1.3.3.148
R7000P - update to 1.3.3.148
RS400 - update to 1.5.1.86
CBR40 - update to 2.5.0.28

• https://kb.netgear.com/000064721/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0324

• Multiple vulnerabilities in NETGEAR Products