Vulnerability · Published Dec 16, 2022 · Assigned by tenable
CVE-2022-47210
High 7.8
In plain English
A high-severity OS command injection in NETGEAR Nighthawk WiFi6 Router. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 44.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | NETGEAR Nighthawk WiFi6 Router | NETGEAR Nighthawk WiFi6 Router prior to V1.0.9.90 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H