PT-2022-27867 · NetGear · Netgear Wnr2000V1

Published 2022-12-20 · Updated 2022-12-29 · CVE-2022-46423

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netgear WNR2000v1 versions 1.2.3.7 and earlier

Description An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a Man-in-the-Middle (MITM) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a Denial of Service (DoS).

Recommendations For versions 1.2.3.7 and earlier, as a temporary workaround, consider restricting access to the firmware update process until a patch is available. Avoid using the vulnerable firmware update mechanism until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2022-46423

Affected Products

Netgear Wnr2000V1

References · 7

• 🔥 https://hackmd.io/@slASVrz_SrW7NQCsunofeA/BktKl8ZDo · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-46423 · Security Note
• https://netgear.com/about/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46423 · Vendor Advisory
• https://t.me/cvenotify/40265 · Telegram Post
• https://t.me/cibsecurity/55003 · Telegram Post
• https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BktKl8ZDo · Note