Sign-up

ID

VAR-202203-1672


CVE

CVE-2022-27644


TITLE

Certificate validation vulnerability in multiple Netgear products

Trust: 0.8

sources: JVNDB: JVNDB-2022-021795

DESCRIPTION

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15797. R6400 firmware, R6700 firmware, R6900P Multiple Netgear products, including firmware, contain vulnerabilities related to certificate validation.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 2.34

sources: NVD: CVE-2022-27644 // JVNDB: JVNDB-2022-021795 // ZDI: ZDI-22-520 // VULMON: CVE-2022-27644

AFFECTED PRODUCTS

vendor:netgearmodel:lbr20scope:ltversion:2.7.4.2

Trust: 1.0

vendor:netgearmodel:rbs10scope:ltversion:2.7.4.24

Trust: 1.0

vendor:netgearmodel:rbs40scope:ltversion:2.7.4.24

Trust: 1.0

vendor:netgearmodel:r6700scope:ltversion:1.0.4.126

Trust: 1.0

vendor:netgearmodel:r6400scope:ltversion:1.0.4.126

Trust: 1.0

vendor:netgearmodel:r7960pscope:ltversion:1.4.3.88

Trust: 1.0

vendor:netgearmodel:cbr40scope:ltversion:2.5.0.28

Trust: 1.0

vendor:netgearmodel:rbr50scope:ltversion:2.7.4.24

Trust: 1.0

vendor:netgearmodel:r8000pscope:ltversion:1.4.3.88

Trust: 1.0

vendor:netgearmodel:rax75scope:ltversion:1.0.6.138

Trust: 1.0

vendor:netgearmodel:r7850scope:ltversion:1.0.5.84

Trust: 1.0

vendor:netgearmodel:rbr40scope:ltversion:2.7.4.24

Trust: 1.0

vendor:netgearmodel:rs400scope:ltversion:1.5.1.86

Trust: 1.0

vendor:netgearmodel:rbs20scope:ltversion:2.7.4.24

Trust: 1.0

vendor:netgearmodel:r7000pscope:ltversion:1.3.3.148

Trust: 1.0

vendor:netgearmodel:rbr20scope:ltversion:2.7.4.24

Trust: 1.0

vendor:netgearmodel:r7000scope:ltversion:1.0.11.134

Trust: 1.0

vendor:netgearmodel:r6900pscope:ltversion:1.3.3.148

Trust: 1.0

vendor:netgearmodel:lbr1020scope:ltversion:2.7.4.2

Trust: 1.0

vendor:netgearmodel:rbr10scope:ltversion:2.7.4.24

Trust: 1.0

vendor:netgearmodel:r8000scope:ltversion:1.0.4.84

Trust: 1.0

vendor:netgearmodel:rax80scope:ltversion:1.0.6.138

Trust: 1.0

vendor:netgearmodel:rax200scope:ltversion:1.0.6.138

Trust: 1.0

vendor:netgearmodel:rbs50scope:ltversion:2.7.4.24

Trust: 1.0

vendor:ネットギアmodel:rbr10scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:cbr40scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r7960pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r8000scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:lbr1020scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbr20scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r7850scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6700scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbr40scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:lbr20scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbr50scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6400scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rs400scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6900pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r7000pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax75scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r7000scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax80scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax200scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r8000pscope: - version: -

Trust: 0.8

vendor:netgearmodel:r6700v3scope: - version: -

Trust: 0.7

sources: ZDI: ZDI-22-520 // JVNDB: JVNDB-2022-021795 // NVD: CVE-2022-27644

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-27644
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2022-27644
value: HIGH

Trust: 1.0

NVD: CVE-2022-27644
value: HIGH

Trust: 0.8

ZDI: CVE-2022-27644
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-202203-2057
value: HIGH

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-27644
baseSeverity: MEDIUM
baseScore: 5.0
vectorString: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 1.6
impactScore: 3.4
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2022-27644
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-27644
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-27644
baseSeverity: MEDIUM
baseScore: 5.0
vectorString: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 1.6
impactScore: 3.4
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-520 // JVNDB: JVNDB-2022-021795 // CNNVD: CNNVD-202203-2057 // NVD: CVE-2022-27644 // NVD: CVE-2022-27644

PROBLEMTYPE DATA

problemtype:CWE-295

Trust: 1.0

problemtype:Illegal certificate verification (CWE-295) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-021795 // NVD: CVE-2022-27644

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202203-2057

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202203-2057

PATCH

title:NETGEAR has issued an update to correct this vulnerability.url:https://kb.netgear.com/000064721/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0324

Trust: 0.7

title:NETGEAR R6700v3 Repair measures for trust management problem vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=232029

Trust: 0.6

sources: ZDI: ZDI-22-520 // CNNVD: CNNVD-202203-2057

EXTERNAL IDS

db:NVDid:CVE-2022-27644

Trust: 4.0

db:ZDIid:ZDI-22-520

Trust: 3.2

db:JVNDBid:JVNDB-2022-021795

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-15797

Trust: 0.7

db:CS-HELPid:SB2022032410

Trust: 0.6

db:CNNVDid:CNNVD-202203-2057

Trust: 0.6

db:VULMONid:CVE-2022-27644

Trust: 0.1

sources: ZDI: ZDI-22-520 // VULMON: CVE-2022-27644 // JVNDB: JVNDB-2022-021795 // CNNVD: CNNVD-202203-2057 // NVD: CVE-2022-27644

REFERENCES

url:https://kb.netgear.com/000064721/security-advisory-for-multiple-vulnerabilities-on-multiple-products-psv-2021-0324

Trust: 3.2

url:https://www.zerodayinitiative.com/advisories/zdi-22-520/

Trust: 3.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-27644

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-27644/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032410

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/295.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-22-520 // VULMON: CVE-2022-27644 // JVNDB: JVNDB-2022-021795 // CNNVD: CNNVD-202203-2057 // NVD: CVE-2022-27644

CREDITS

Kevin Denis (@0xmitsurugi) and Antide Petit (@xarkes_) from @Synacktiv

Trust: 1.3

sources: ZDI: ZDI-22-520 // CNNVD: CNNVD-202203-2057

SOURCES

db:ZDIid:ZDI-22-520
db:VULMONid:CVE-2022-27644
db:JVNDBid:JVNDB-2022-021795
db:CNNVDid:CNNVD-202203-2057
db:NVDid:CVE-2022-27644

LAST UPDATE DATE

2024-08-14T13:42:55.980000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-520date:2022-03-23T00:00:00
db:VULMONid:CVE-2022-27644date:2023-03-30T00:00:00
db:JVNDBid:JVNDB-2022-021795date:2023-11-14T04:15:00
db:CNNVDid:CNNVD-202203-2057date:2023-04-06T00:00:00
db:NVDid:CVE-2022-27644date:2023-04-05T15:22:23.963

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-520date:2022-03-23T00:00:00
db:VULMONid:CVE-2022-27644date:2023-03-29T00:00:00
db:JVNDBid:JVNDB-2022-021795date:2023-11-14T00:00:00
db:CNNVDid:CNNVD-202203-2057date:2022-03-23T00:00:00
db:NVDid:CVE-2022-27644date:2023-03-29T19:15:08.563