CVE-2022-27945
Published: 26 March 2022
Summary
CVE-2022-27945 is a high-severity OS Command Injection (CWE-78) vulnerability in Netgear R8500 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 10.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
NETGEAR R8500 devices running firmware version 1.0.2.158 contain an OS command injection vulnerability tracked as CVE-2022-27945 and CWE-78. The flaw resides in password.cgi, where the sysNewPasswd and sysConfirmPasswd parameters are processed without proper sanitization of shell metacharacters, allowing command execution when password changes are submitted.
Remote authenticated users can exploit the issue over the network with low attack complexity. Successful exploitation grants the ability to run arbitrary system commands, such as starting a telnet daemon, resulting in full compromise of device confidentiality, integrity, and availability as reflected in the CVSS 8.8 score.
The two provided references point to the same GitHub disclosure file and contain no vendor advisory, patch, or mitigation guidance. The associated EPSS score has remained low, reaching a modest peak of 0.0644 before receding to the current value of 0.0500.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-32433
Vulnerability details
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.