CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-27946
https://notcve.org/view.php?id=CVE-2022-27946
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi. Los dispositivos NETGEAR R8500 versión 1.0.2.158, permiten a usuarios remotos autenticados ejecutar comandos arbitrarios (como telnetd) por medio de metacaracteres de shell en los parámetros sysNewPasswd y sysConfirmPasswd del archivo admin_account.cgi • https://github.com/donothingme/VUL/blob/main/vul3/3.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-27947
https://notcve.org/view.php?id=CVE-2022-27947
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameter. Los dispositivos NETGEAR R8500 versión 1.0.2.158, permiten a usuarios remotos autenticados ejecutar comandos arbitrarios (como telnetd) por medio de metacaracteres de shell en los parámetros ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length o ipv6_lan_length • https://github.com/donothingme/VUL/blob/main/vul1/1.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-27945
https://notcve.org/view.php?id=CVE-2022-27945
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi. Los dispositivos NETGEAR R8500 versión 1.0.2.158, permiten a usuarios remotos autenticados ejecutar comandos arbitrarios (como telnetd) por medio de metacaracteres de shell en los parámetros sysNewPasswd y sysConfirmPasswd del archivo password.cgi • https://github.com/donothingme/VUL/blob/main/vul2/2.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.0EPSS: 0%CPEs: 68EXPL: 0CVE-2022-27647 – NETGEAR R6700v3 libreadycloud.so Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-27647
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the name or email field provided to libreadycloud.so. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. • https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327 https://www.zerodayinitiative.com/advisories/ZDI-22-524 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 68EXPL: 0CVE-2022-27642 – NETGEAR R6700v3 httpd Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-27642
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. • https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327 https://www.zerodayinitiative.com/advisories/ZDI-22-518 • CWE-863: Incorrect Authorization •