Sign-up

ID

VAR-202301-2429


CVE

CVE-2022-48176


TITLE

plural  Netgear  Out-of-bounds write vulnerability in router products

Trust: 0.8

sources: JVNDB: JVNDB-2022-011999

DESCRIPTION

Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to contain a pre-authentication stack overflow. plural Netgear Router products contain an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.71

sources: NVD: CVE-2022-48176 // JVNDB: JVNDB-2022-011999 // VULMON: CVE-2022-48176

AFFECTED PRODUCTS

vendor:netgearmodel:r8000pscope:ltversion:1.4.4.94

Trust: 1.0

vendor:netgearmodel:mr60scope:ltversion:1.1.7.132

Trust: 1.0

vendor:netgearmodel:r7960pscope:ltversion:1.4.4.94

Trust: 1.0

vendor:netgearmodel:r6900pscope:ltversion:1.3.3.154

Trust: 1.0

vendor:netgearmodel:r7000pscope:ltversion:1.3.3.154

Trust: 1.0

vendor:netgearmodel:ms60scope:ltversion:1.1.7.132

Trust: 1.0

vendor:ネットギアmodel:r6900pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r7000pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r7960pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r8000pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:ms60scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:mr60scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-011999 // NVD: CVE-2022-48176

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-48176
value: HIGH

Trust: 1.0

NVD: CVE-2022-48176
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202301-2386
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2022-48176
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-48176
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-011999 // CNNVD: CNNVD-202301-2386 // NVD: CVE-2022-48176

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-011999 // NVD: CVE-2022-48176

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202301-2386

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202301-2386

PATCH

title:Security Advisory for Pre-authentication Stack Overflow on some Routers and Nighthawk WiFi Mesh Systems, PSV-2022-0146 NETGEAR Supporturl:https://kb.netgear.com/000065242/Security-Advisory-for-Pre-authentication-Stack-Overflow-on-some-Routers-and-Nighthawk-WiFi-Mesh-Systems-PSV-2022-0146

Trust: 0.8

title:Netgear Routers R7000P Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=224345

Trust: 0.6

title: - url:https://github.com/Live-Hack-CVE/CVE-2022-48176

Trust: 0.1

sources: VULMON: CVE-2022-48176 // JVNDB: JVNDB-2022-011999 // CNNVD: CNNVD-202301-2386

EXTERNAL IDS

db:NVDid:CVE-2022-48176

Trust: 3.3

db:JVNDBid:JVNDB-2022-011999

Trust: 0.8

db:CNNVDid:CNNVD-202301-2386

Trust: 0.6

db:VULMONid:CVE-2022-48176

Trust: 0.1

sources: VULMON: CVE-2022-48176 // JVNDB: JVNDB-2022-011999 // CNNVD: CNNVD-202301-2386 // NVD: CVE-2022-48176

REFERENCES

url:https://hdwsec.fr/blog/20221109-netgear/

Trust: 1.7

url:https://www.netgear.com/about/security/

Trust: 1.7

url:https://kb.netgear.com/000065242/security-advisory-for-pre-authentication-stack-overflow-on-some-routers-and-nighthawk-wifi-mesh-systems-psv-2022-0146

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2022-48176

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-48176/

Trust: 0.6

url:https://github.com/live-hack-cve/cve-2022-48176

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2022-48176 // JVNDB: JVNDB-2022-011999 // CNNVD: CNNVD-202301-2386 // NVD: CVE-2022-48176

SOURCES

db:VULMONid:CVE-2022-48176
db:JVNDBid:JVNDB-2022-011999
db:CNNVDid:CNNVD-202301-2386
db:NVDid:CVE-2022-48176

LAST UPDATE DATE

2024-08-14T15:37:09.962000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2022-48176date:2023-01-31T00:00:00
db:JVNDBid:JVNDB-2022-011999date:2023-08-25T04:45:00
db:CNNVDid:CNNVD-202301-2386date:2023-02-09T00:00:00
db:NVDid:CVE-2022-48176date:2023-02-08T02:02:09.553

SOURCES RELEASE DATE

db:VULMONid:CVE-2022-48176date:2023-01-31T00:00:00
db:JVNDBid:JVNDB-2022-011999date:2023-08-25T00:00:00
db:CNNVDid:CNNVD-202301-2386date:2023-01-31T00:00:00
db:NVDid:CVE-2022-48176date:2023-01-31T00:15:10.327