Is CVE-2022-27641 actively exploited?

CVE-2022-27641 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2022-27641?

CVE-2022-27641 has a CVSS score of 8.8 (HIGH severity). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How do I patch CVE-2022-27641?

Patch guidance is available from netgear security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2022-27641.

Fix CVE-2022-27641 - HIGH netgear d7800 firmware

Q: Which products are affected by CVE-2022-27641?

9 products: netgear d7800 firmware, netgear ex6200 firmware, netgear ex8000 firmware, netgear r6220 firmware, netgear r6230 firmware, and 4 more.

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15806.

CVSS Metrics

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector: adjacent network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-190 · Integer Overflow

Metadata

Primary Vendor: NETGEAR
Published: 3/29/2023
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

netgear : d7800_firmwarenetgear : ex6200_firmwarenetgear : ex8000_firmwarenetgear : r6220_firmwarenetgear : r6230_firmwarenetgear : r6400_firmwarenetgear : r6700_firmwarenetgear : r7000_firmwarenetgear : r7800_firmware

Remediation Guidance

Executive Summary

View on NIST NVD