Command Injection in NETGEAR products - #VU77788
Published: June 29, 2023
Vulnerability identifier: #VU77788
CSH Severity: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-77
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
C7000v2
RAX42
RAX43
RAX48
RAX45
RAX50S
RAX38v2
RAX50
RAX35v2
RAX40v2
CAX80
RAXE500
RAXE450
C7000v2
RAX42
RAX43
RAX48
RAX45
RAX50S
RAX38v2
RAX50
RAX35v2
RAX40v2
CAX80
RAXE500
RAXE450
Software vendor:
NETGEAR
NETGEAR
Description
The vulnerability allows a local attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation. An attacker with physical access can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install updates from vendor's website.