Command Injection in NETGEAR products - #VU64824
Published: June 30, 2022
Vulnerability identifier: #VU64824
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-77
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation. A remote administrator on the local network can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
EAX20
EAX80
EX7000
RAX35v2
RAX40v2
RAX43
RAX50
RAX15
RAX45
RAX20
RAX80
RAX200
RAX75
MK62
MR60
MS60
MK83
MR80
MS80
LAX20
R8000P
R7900P
R7960P
RBW30
RBK752
RBR750
RBR850
RBS750
RBS850
RBK852
XR1000
R6400
R7900
R8000
R6400v2
R7850
R7000
R7000P
EAX80
EX7000
RAX35v2
RAX40v2
RAX43
RAX50
RAX15
RAX45
RAX20
RAX80
RAX200
RAX75
MK62
MR60
MS60
MK83
MR80
MS80
LAX20
R8000P
R7900P
R7960P
RBW30
RBK752
RBR750
RBR850
RBS750
RBS850
RBK852
XR1000
R6400
R7900
R8000
R6400v2
R7850
R7000
R7000P
Remediation
Install updates from vendor's website.
EAX20 - update to 1.0.0.58
XR1000 - update to 1.0.0.58
EAX80 - update to 1.0.1.68
R6400 - update to 1.0.1.70
EX7000 - update to 1.0.1.104
RAX35v2 - update to 1.0.3.96
RAX40v2 - update to 1.0.3.96
RAX43 - update to 1.0.3.96
RAX50 - update to 1.0.3.96
RAX15 - update to 1.0.3.96
RAX45 - update to 1.0.3.96
RAX20 - update to 1.0.3.96
R7900 - update to 1.0.4.46
R8000 - update to 1.0.4.74
R6400v2 - update to 1.0.4.118
RAX80 - update to 1.0.4.120
RAX200 - update to 1.0.4.120
RAX75 - update to 1.0.4.120
R7850 - update to 1.0.5.74
MK62 - update to 1.0.6.116
MR60 - update to 1.0.6.116
MS60 - update to 1.0.6.116
R7000 - update to 1.0.11.126
MK83 - update to 1.1.6.14
MR80 - update to 1.1.6.14
MS80 - update to 1.1.6.14
LAX20 - update to 1.1.6.28
R7000P - update to 1.3.3.148
R8000P - update to 1.4.2.84
R7900P - update to 1.4.2.84
R7960P - update to 1.4.2.84
RBW30 - update to 2.6.2.6
RBK752 - update to 3.2.17.12
RBR750 - update to 3.2.17.12
RBR850 - update to 3.2.17.12
RBS750 - update to 3.2.17.12
RBS850 - update to 3.2.17.12
RBK852 - update to 3.2.17.12
XR1000 - update to 1.0.0.58
EAX80 - update to 1.0.1.68
R6400 - update to 1.0.1.70
EX7000 - update to 1.0.1.104
RAX35v2 - update to 1.0.3.96
RAX40v2 - update to 1.0.3.96
RAX43 - update to 1.0.3.96
RAX50 - update to 1.0.3.96
RAX15 - update to 1.0.3.96
RAX45 - update to 1.0.3.96
RAX20 - update to 1.0.3.96
R7900 - update to 1.0.4.46
R8000 - update to 1.0.4.74
R6400v2 - update to 1.0.4.118
RAX80 - update to 1.0.4.120
RAX200 - update to 1.0.4.120
RAX75 - update to 1.0.4.120
R7850 - update to 1.0.5.74
MK62 - update to 1.0.6.116
MR60 - update to 1.0.6.116
MS60 - update to 1.0.6.116
R7000 - update to 1.0.11.126
MK83 - update to 1.1.6.14
MR80 - update to 1.1.6.14
MS80 - update to 1.1.6.14
LAX20 - update to 1.1.6.28
R7000P - update to 1.3.3.148
R8000P - update to 1.4.2.84
R7900P - update to 1.4.2.84
R7960P - update to 1.4.2.84
RBW30 - update to 2.6.2.6
RBK752 - update to 3.2.17.12
RBR750 - update to 3.2.17.12
RBR850 - update to 3.2.17.12
RBS750 - update to 3.2.17.12
RBS850 - update to 3.2.17.12
RBK852 - update to 3.2.17.12