CVE-2022-4390
First published: Fri Dec 09 2022(Updated: )
A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network.
Credit: vulnreport@tenable.com vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netgear Nighthawk AX2400 Firmware | <1.0.9.90 | |
| Netgear Nighthawk AX2400 | ||
| All of | ||
| Netgear Nighthawk AX2400 Firmware | <1.0.9.90 | |
| Netgear Nighthawk AX2400 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-4390?
CVE-2022-4390 is classified as a medium severity vulnerability due to network misconfiguration.
How do I fix CVE-2022-4390?
To fix CVE-2022-4390, update the NETGEAR RAX30 AX2400 firmware to version 1.0.9.90 or later.
What devices are affected by CVE-2022-4390?
CVE-2022-4390 affects the NETGEAR RAX30 AX2400 series routers with firmware versions prior to 1.0.9.90.
What is the nature of the misconfiguration in CVE-2022-4390?
The misconfiguration in CVE-2022-4390 involves IPv6 being enabled by default for the WAN interface.
Are firewall restrictions in place for CVE-2022-4390?
Yes, there are firewall restrictions for IPv4 traffic, but they do not extend to the IPv6 traffic, creating potential exposure.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/references
- agent/description
- agent/first-publish-date
- agent/last-modified-date
- agent/author
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/netgear
- canonical/netgear nighthawk ax2400 firmware
- canonical/netgear nighthawk ax2400