ZDI-22-522: (Pwn2Own) NETGEAR R6700v3 readycloud_control.cgi Authentication Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloudcontrol.cgi. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-22-522?
The severity of ZDI-22-522 is classified as a critical vulnerability due to the ability for attackers to bypass authentication.
How do I fix ZDI-22-522?
To fix ZDI-22-522, update the firmware of your NETGEAR R6700v3 router to the latest version provided by NETGEAR.
Who is affected by ZDI-22-522?
ZDI-22-522 affects users of NETGEAR R6700v3 routers that have not been updated to a secure firmware version.
What kind of attacks can be performed using ZDI-22-522?
Using ZDI-22-522, an attacker could perform unauthorized actions on the router without needing authentication.
Is authentication needed to exploit ZDI-22-522?
No, authentication is not required to exploit the ZDI-22-522 vulnerability.