PT-2023-3101 · NetGear · Netgear R8500+3

D2Y6P · Published 2023-05-22 · Updated 2025-01-08 · CVE-2023-33533

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netgear D6220 version 1.0.0.80 Netgear D8500 version 1.0.3.60 Netgear R6700 version 1.0.2.26 Netgear R6900 version 1.0.2.26

Description The issue is related to the lack of input data sanitization in the firmware of Netgear routers. This allows an attacker with web management privileges to inject commands into the post request parameters, potentially gaining shell privileges.

Recommendations For Netgear D6220 version 1.0.0.80, consider disabling web management privileges until a patch is available. For Netgear D8500 version 1.0.3.60, restrict access to post request parameters to minimize the risk of exploitation. For Netgear R6700 version 1.0.2.26, avoid using the vulnerable firmware until an update is released. For Netgear R6900 version 1.0.2.26, limit the use of shell privileges to prevent potential command injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-03192

CVE-2023-33533

Affected Products

Netgear R6220

Netgear R8500

Netgear R6700

Netgear R6900P

References · 8

• 🔥 https://github.com/D2y6p/CVE/blob/main/Netgear/CVE-2023-33533/Netgear_RCE.pdf · Exploit
• https://netgear.com/about/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33533 · Security Note
• https://bdu.fstec.ru/vul/2023-03192 · Security Note
• https://vuldb.com/ru/?id.230845 · Note
• https://t.me/cvenotify/52346 · Telegram Post
• https://t.me/cvenotify/51888 · Telegram Post