Command Injection in NETGEAR products - #VU64827
Published: June 30, 2022
Vulnerability identifier: #VU64827
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-77
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation. A remote administrator on the local network can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
XR1000
R6400
R7900
R6300v2
R8000
R6400v2
R7850
R7000
R7000P
RAX35v2
RAX45
RAX20
RAX15
RAX50
RAX43
RAX40v2
RAX80
RAX75
RAX200
MS60
MR60
MK62
MK83
MR80
MS80
LAX20
R8000P
R7960P
RBR750
RBR850
RBS750
RBS850
RBK752
RBK852
CBR750
R6400
R7900
R6300v2
R8000
R6400v2
R7850
R7000
R7000P
RAX35v2
RAX45
RAX20
RAX15
RAX50
RAX43
RAX40v2
RAX80
RAX75
RAX200
MS60
MR60
MK62
MK83
MR80
MS80
LAX20
R8000P
R7960P
RBR750
RBR850
RBS750
RBS850
RBK752
RBK852
CBR750
Remediation
Install updates from vendor's website.
XR1000 - update to 1.0.0.58
R6400 - update to 1.0.1.70
RAX35v2 - update to 1.0.3.96
RAX45 - update to 1.0.3.96
RAX20 - update to 1.0.3.96
RAX15 - update to 1.0.3.96
RAX50 - update to 1.0.3.96
RAX43 - update to 1.0.3.96
RAX40v2 - update to 1.0.3.96
R7900 - update to 1.0.4.38
R6300v2 - update to 1.0.4.52
R8000 - update to 1.0.4.74
RAX80 - update to 1.0.4.120
RAX75 - update to 1.0.4.120
RAX200 - update to 1.0.4.120
R6400v2 - update to 1.0.4.122
R7850 - update to 1.0.5.74
MS60 - update to 1.0.6.116
MR60 - update to 1.0.6.116
MK62 - update to 1.0.6.116
R7000 - update to 1.0.11.126
MK83 - update to 1.1.6.4
MR80 - update to 1.1.6.4
MS80 - update to 1.1.6.4
LAX20 - update to 1.1.6.28
R7000P - update to 1.3.3.148
R8000P - update to 1.4.2.84
R7960P - update to 1.4.2.84
RBR750 - update to 3.2.17.12
RBR850 - update to 3.2.17.12
RBS750 - update to 3.2.17.12
RBS850 - update to 3.2.17.12
RBK752 - update to 3.2.17.12
RBK852 - update to 3.2.17.12
CBR750 - update to 4.6.3.6
R6400 - update to 1.0.1.70
RAX35v2 - update to 1.0.3.96
RAX45 - update to 1.0.3.96
RAX20 - update to 1.0.3.96
RAX15 - update to 1.0.3.96
RAX50 - update to 1.0.3.96
RAX43 - update to 1.0.3.96
RAX40v2 - update to 1.0.3.96
R7900 - update to 1.0.4.38
R6300v2 - update to 1.0.4.52
R8000 - update to 1.0.4.74
RAX80 - update to 1.0.4.120
RAX75 - update to 1.0.4.120
RAX200 - update to 1.0.4.120
R6400v2 - update to 1.0.4.122
R7850 - update to 1.0.5.74
MS60 - update to 1.0.6.116
MR60 - update to 1.0.6.116
MK62 - update to 1.0.6.116
R7000 - update to 1.0.11.126
MK83 - update to 1.1.6.4
MR80 - update to 1.1.6.4
MS80 - update to 1.1.6.4
LAX20 - update to 1.1.6.28
R7000P - update to 1.3.3.148
R8000P - update to 1.4.2.84
R7960P - update to 1.4.2.84
RBR750 - update to 3.2.17.12
RBR850 - update to 3.2.17.12
RBS750 - update to 3.2.17.12
RBS850 - update to 3.2.17.12
RBK752 - update to 3.2.17.12
RBK852 - update to 3.2.17.12
CBR750 - update to 4.6.3.6