// For flags

CVE-2022-27644

NETGEAR R6700v3 Improper Certificate Validation Vulnerability

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15797.

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

*Credits: Kevin Denis (@0xmitsurugi) and Antide Petit (@xarkes_) from @Synacktiv
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-03-22 CVE Reserved
  • 2022-03-23 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-09-08 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Netgear
Search vendor "Netgear"
R6400 Firmware
Search vendor "Netgear" for product "R6400 Firmware"
< 1.0.4.126
Search vendor "Netgear" for product "R6400 Firmware" and version " < 1.0.4.126"
-
Affected
in Netgear
Search vendor "Netgear"
R6400
Search vendor "Netgear" for product "R6400"
v2
Search vendor "Netgear" for product "R6400" and version "v2"
-
Safe
Netgear
Search vendor "Netgear"
R6700 Firmware
Search vendor "Netgear" for product "R6700 Firmware"
< 1.0.4.126
Search vendor "Netgear" for product "R6700 Firmware" and version " < 1.0.4.126"
-
Affected
in Netgear
Search vendor "Netgear"
R6700
Search vendor "Netgear" for product "R6700"
v3
Search vendor "Netgear" for product "R6700" and version "v3"
-
Safe
Netgear
Search vendor "Netgear"
R6900p Firmware
Search vendor "Netgear" for product "R6900p Firmware"
< 1.3.3.148
Search vendor "Netgear" for product "R6900p Firmware" and version " < 1.3.3.148"
-
Affected
in Netgear
Search vendor "Netgear"
R6900p
Search vendor "Netgear" for product "R6900p"
--
Safe
Netgear
Search vendor "Netgear"
R7000 Firmware
Search vendor "Netgear" for product "R7000 Firmware"
< 1.0.11.134
Search vendor "Netgear" for product "R7000 Firmware" and version " < 1.0.11.134"
-
Affected
in Netgear
Search vendor "Netgear"
R7000
Search vendor "Netgear" for product "R7000"
--
Safe
Netgear
Search vendor "Netgear"
R7000p Firmware
Search vendor "Netgear" for product "R7000p Firmware"
< 1.3.3.148
Search vendor "Netgear" for product "R7000p Firmware" and version " < 1.3.3.148"
-
Affected
in Netgear
Search vendor "Netgear"
R7000p
Search vendor "Netgear" for product "R7000p"
--
Safe
Netgear
Search vendor "Netgear"
R7850 Firmware
Search vendor "Netgear" for product "R7850 Firmware"
< 1.0.5.84
Search vendor "Netgear" for product "R7850 Firmware" and version " < 1.0.5.84"
-
Affected
in Netgear
Search vendor "Netgear"
R7850
Search vendor "Netgear" for product "R7850"
--
Safe
Netgear
Search vendor "Netgear"
R7960p Firmware
Search vendor "Netgear" for product "R7960p Firmware"
< 1.4.3.88
Search vendor "Netgear" for product "R7960p Firmware" and version " < 1.4.3.88"
-
Affected
in Netgear
Search vendor "Netgear"
R7960p
Search vendor "Netgear" for product "R7960p"
--
Safe
Netgear
Search vendor "Netgear"
R8000 Firmware
Search vendor "Netgear" for product "R8000 Firmware"
< 1.0.4.84
Search vendor "Netgear" for product "R8000 Firmware" and version " < 1.0.4.84"
-
Affected
in Netgear
Search vendor "Netgear"
R8000
Search vendor "Netgear" for product "R8000"
--
Safe
Netgear
Search vendor "Netgear"
R8000p Firmware
Search vendor "Netgear" for product "R8000p Firmware"
< 1.4.3.88
Search vendor "Netgear" for product "R8000p Firmware" and version " < 1.4.3.88"
-
Affected
in Netgear
Search vendor "Netgear"
R8000p
Search vendor "Netgear" for product "R8000p"
--
Safe
Netgear
Search vendor "Netgear"
Rax200 Firmware
Search vendor "Netgear" for product "Rax200 Firmware"
< 1.0.6.138
Search vendor "Netgear" for product "Rax200 Firmware" and version " < 1.0.6.138"
-
Affected
in Netgear
Search vendor "Netgear"
Rax200
Search vendor "Netgear" for product "Rax200"
--
Safe
Netgear
Search vendor "Netgear"
Rax75 Firmware
Search vendor "Netgear" for product "Rax75 Firmware"
< 1.0.6.138
Search vendor "Netgear" for product "Rax75 Firmware" and version " < 1.0.6.138"
-
Affected
in Netgear
Search vendor "Netgear"
Rax75
Search vendor "Netgear" for product "Rax75"
--
Safe
Netgear
Search vendor "Netgear"
Rax80 Firmware
Search vendor "Netgear" for product "Rax80 Firmware"
< 1.0.6.138
Search vendor "Netgear" for product "Rax80 Firmware" and version " < 1.0.6.138"
-
Affected
in Netgear
Search vendor "Netgear"
Rax80
Search vendor "Netgear" for product "Rax80"
--
Safe
Netgear
Search vendor "Netgear"
Rs400 Firmware
Search vendor "Netgear" for product "Rs400 Firmware"
< 1.5.1.86
Search vendor "Netgear" for product "Rs400 Firmware" and version " < 1.5.1.86"
-
Affected
in Netgear
Search vendor "Netgear"
Rs400
Search vendor "Netgear" for product "Rs400"
--
Safe
Netgear
Search vendor "Netgear"
Cbr40 Firmware
Search vendor "Netgear" for product "Cbr40 Firmware"
< 2.5.0.28
Search vendor "Netgear" for product "Cbr40 Firmware" and version " < 2.5.0.28"
-
Affected
in Netgear
Search vendor "Netgear"
Cbr40
Search vendor "Netgear" for product "Cbr40"
--
Safe
Netgear
Search vendor "Netgear"
Lbr1020 Firmware
Search vendor "Netgear" for product "Lbr1020 Firmware"
< 2.7.4.2
Search vendor "Netgear" for product "Lbr1020 Firmware" and version " < 2.7.4.2"
-
Affected
in Netgear
Search vendor "Netgear"
Lbr1020
Search vendor "Netgear" for product "Lbr1020"
--
Safe
Netgear
Search vendor "Netgear"
Lbr20 Firmware
Search vendor "Netgear" for product "Lbr20 Firmware"
< 2.7.4.2
Search vendor "Netgear" for product "Lbr20 Firmware" and version " < 2.7.4.2"
-
Affected
in Netgear
Search vendor "Netgear"
Lbr20
Search vendor "Netgear" for product "Lbr20"
--
Safe
Netgear
Search vendor "Netgear"
Rbr10 Firmware
Search vendor "Netgear" for product "Rbr10 Firmware"
< 2.7.4.24
Search vendor "Netgear" for product "Rbr10 Firmware" and version " < 2.7.4.24"
-
Affected
in Netgear
Search vendor "Netgear"
Rbr10
Search vendor "Netgear" for product "Rbr10"
--
Safe
Netgear
Search vendor "Netgear"
Rbr20 Firmware
Search vendor "Netgear" for product "Rbr20 Firmware"
< 2.7.4.24
Search vendor "Netgear" for product "Rbr20 Firmware" and version " < 2.7.4.24"
-
Affected
in Netgear
Search vendor "Netgear"
Rbr20
Search vendor "Netgear" for product "Rbr20"
--
Safe
Netgear
Search vendor "Netgear"
Rbr40 Firmware
Search vendor "Netgear" for product "Rbr40 Firmware"
< 2.7.4.24
Search vendor "Netgear" for product "Rbr40 Firmware" and version " < 2.7.4.24"
-
Affected
in Netgear
Search vendor "Netgear"
Rbr40
Search vendor "Netgear" for product "Rbr40"
--
Safe
Netgear
Search vendor "Netgear"
Rbr50 Firmware
Search vendor "Netgear" for product "Rbr50 Firmware"
< 2.7.4.24
Search vendor "Netgear" for product "Rbr50 Firmware" and version " < 2.7.4.24"
-
Affected
in Netgear
Search vendor "Netgear"
Rbr50
Search vendor "Netgear" for product "Rbr50"
--
Safe
Netgear
Search vendor "Netgear"
Rbs10 Firmware
Search vendor "Netgear" for product "Rbs10 Firmware"
< 2.7.4.24
Search vendor "Netgear" for product "Rbs10 Firmware" and version " < 2.7.4.24"
-
Affected
in Netgear
Search vendor "Netgear"
Rbs10
Search vendor "Netgear" for product "Rbs10"
--
Safe
Netgear
Search vendor "Netgear"
Rbs20 Firmware
Search vendor "Netgear" for product "Rbs20 Firmware"
< 2.7.4.24
Search vendor "Netgear" for product "Rbs20 Firmware" and version " < 2.7.4.24"
-
Affected
in Netgear
Search vendor "Netgear"
Rbs20
Search vendor "Netgear" for product "Rbs20"
--
Safe
Netgear
Search vendor "Netgear"
Rbs40 Firmware
Search vendor "Netgear" for product "Rbs40 Firmware"
< 2.7.4.24
Search vendor "Netgear" for product "Rbs40 Firmware" and version " < 2.7.4.24"
-
Affected
in Netgear
Search vendor "Netgear"
Rbs40
Search vendor "Netgear" for product "Rbs40"
--
Safe
Netgear
Search vendor "Netgear"
Rbs50 Firmware
Search vendor "Netgear" for product "Rbs50 Firmware"
< 2.7.4.24
Search vendor "Netgear" for product "Rbs50 Firmware" and version " < 2.7.4.24"
-
Affected
in Netgear
Search vendor "Netgear"
Rbs50
Search vendor "Netgear" for product "Rbs50"
--
Safe