CVE-2022-27947: OS Command Injection
Published Mar 26, 2022
·Updated
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6fix.cgi ipv6wanipaddr, ipv6lanipaddr, ipv6wanlength, or ipv6lanlength parameter.
Affected Software
2 affected components
Netgear R8500 Firmware=1.0.2.158
Netgear R8500
Remediation
Patch Available
Event History
Mar 26, 2022
CVE Published
via MITRE·04:13 PM
Data Sourced
via MITRE·04:13 PM
Description
Frequently Asked Questions
1
What is CVE-2022-27947?
CVE-2022-27947 is a vulnerability in NETGEAR R8500 1.0.2.158 devices that allows remote authenticated users to execute arbitrary commands.
2
How can remote authenticated users exploit CVE-2022-27947?
Remote authenticated users can exploit CVE-2022-27947 by using shell metacharacters in the ipv6_fix.cgi parameters.
3
What is the severity of CVE-2022-27947?
CVE-2022-27947 has a severity rating of 8.8 (critical).
4
Is NETGEAR R8500 1.0.2.158 firmware affected by CVE-2022-27947?
Yes, NETGEAR R8500 1.0.2.158 firmware is affected by CVE-2022-27947.
5
Is there a fix for CVE-2022-27947?
Yes, updating the firmware of NETGEAR R8500 devices to a non-vulnerable version will fix CVE-2022-27947.