PT-2021-6473 · NetGear · Netgear Rax15+20

Bugscale Team · Published 2021-12-01 · Updated 2024-12-19 · CVE-2022-27642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR R6700v3 version 1.0.4.120 10.0.91 NETGEAR R6400 versions (affected versions not specified) NETGEAR R6400v2 versions (affected versions not specified) NETGEAR R6900P versions (affected versions not specified) NETGEAR R7000 versions (affected versions not specified) NETGEAR R7000P versions (affected versions not specified) NETGEAR R8500 versions (affected versions not specified) NETGEAR RAX15 versions (affected versions not specified) NETGEAR RAX20 versions (affected versions not specified) NETGEAR RAX35v2 versions (affected versions not specified) NETGEAR RAX38v2 versions (affected versions not specified) NETGEAR RAX40v2 versions (affected versions not specified) NETGEAR RAX42 versions (affected versions not specified) NETGEAR RAX43 versions (affected versions not specified) NETGEAR RAX45 versions (affected versions not specified) NETGEAR RAX48 versions (affected versions not specified) NETGEAR RAX50 versions (affected versions not specified) NETGEAR RAX50S versions (affected versions not specified) NETGEAR RS400 versions (affected versions not specified) NETGEAR R7100LG versions (affected versions not specified) NETGEAR LAX20 versions (affected versions not specified) NETGEAR CAX80 versions (affected versions not specified) NETGEAR MR80 versions (affected versions not specified) NETGEAR MS80 versions (affected versions not specified)

Description This issue allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR routers. The specific flaw exists within the httpd service, resulting from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other issues to execute code in the context of root. The vulnerability is related to bypassing authentication via an alternative name.

Recommendations For NETGEAR R6700v3 version 1.0.4.120 10.0.91, consider disabling the httpd service until a patch is available. For other affected NETGEAR devices, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Incorrect Authorization

Weakness Enumeration

CWE-200

CWE-289

CWE-863

Related Identifiers

BDU:2022-01711

CVE-2022-27642

ZDI-22-518

Affected Products

Netgear Rax80

Netgear Rax20

Netgear Ms80

Netgear R6400

Netgear R6400V2

Netgear R6700V3

Netgear R6900P

Netgear R7000

Netgear R7000P

Netgear R7100Lg

Netgear R8500

Netgear Rax15

Netgear Rax35V2

Netgear Rax38V2

Netgear Rax40V2

Netgear Rax42

Netgear Rax43

Netgear Rax45

Netgear Rax48

Netgear Rax50

Netgear Rs400

References · 8

• https://osv.dev/vulnerability/CVE-2022-27642 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-518 · Security Note
• https://bdu.fstec.ru/vul/2022-01711 · Security Note
• https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27642 · Security Note
• https://t.me/cibsecurity/61121 · Telegram Post
• https://twitter.com/CveFindCom/status/1869745186990903571 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2022032410 · Note