PT-2023-2000 · NetGear · Netgear Orbi Router Rbr750

Dave Mcdaniel

·

Publicado

2023-03-21

·

Atualizado

2023-03-29

·

CVE-2022-38452

CVSS v2.0

9.0

Alta

VetorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Netgear Orbi Router RBR750 version 4.6.8.5
Description A command execution issue exists in the hidden telnet service functionality. This can be exploited by sending a specially-crafted network request, potentially allowing an attacker to execute arbitrary commands. The issue is related to the use of the Blowfish cryptographic algorithm in the crypt 64bit up/down() function.
Recommendations For Netgear Orbi Router RBR750 version 4.6.8.5, consider disabling the hidden telnet service functionality until a patch is available. Restrict access to the UDP port 23 to minimize the risk of exploitation. Avoid using the vulnerable crypt 64bit up/down() function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Hidden Functionality

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-912

Identificadores relacionados

BDU:2023-01623
CVE-2022-38452

Produtos afetados

Netgear Orbi Router Rbr750