CVE-2022-27647

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-29 · updated 2026-06-17
Weakness: CWE-78

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the name or email field provided to libreadycloud.so. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15874.

Affected products

NETGEAR Cax80 Firmware: before 2.1.3.7 — fixed in 2.1.3.7
NETGEAR Lax20 Firmware: before 1.1.6.34 — fixed in 1.1.6.34
NETGEAR Mr60 Firmware: before 1.1.6.124 — fixed in 1.1.6.124
NETGEAR Mr80 Firmware: before 1.1.6.14 — fixed in 1.1.6.14
NETGEAR Ms60 Firmware: before 1.1.6.124 — fixed in 1.1.6.124
NETGEAR Ms80 Firmware: before 1.1.6.14 — fixed in 1.1.6.14
NETGEAR R6400 Firmware: before 1.0.1.78; before 1.0.4.126 — fixed in 1.0.1.78, 1.0.4.126
NETGEAR R6700: before 1.0.4.126 — fixed in 1.0.4.126
NETGEAR R6900P Firmware: before 1.3.3.148 — fixed in 1.3.3.148
NETGEAR R7000: before 1.0.11.134 — fixed in 1.0.11.134
NETGEAR R7000P: before 1.3.3.148 — fixed in 1.3.3.148
NETGEAR R7100Lg Firmware: before 1.0.0.76 — fixed in 1.0.0.76
NETGEAR R7850 Firmware: before 1.0.5.84 — fixed in 1.0.5.84
NETGEAR R7900P Firmware: before 1.4.3.88 — fixed in 1.4.3.88
NETGEAR R7960P Firmware: before 1.4.3.88 — fixed in 1.4.3.88
NETGEAR R8000 Firmware: before 1.0.4.84 — fixed in 1.0.4.84
NETGEAR R8000P Firmware: before 1.4.3.88 — fixed in 1.4.3.88
NETGEAR R8500 Firmware: before 1.0.2.158 — fixed in 1.0.2.158
NETGEAR Rax15 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax200 Firmware: before 1.0.6.138 — fixed in 1.0.6.138
NETGEAR Rax20 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax35 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax38 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax40 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax42 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
Netgear RAX43: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax45 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax48 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax50 Firmware: before 1.0.10.110 — fixed in 1.0.10.110
NETGEAR Rax50S Firmware: before 1.0.10.110 — fixed in 1.0.10.110

How to fix

Upgrade to a fixed version: NETGEAR Cax80 Firmware 2.1.3.7; NETGEAR Lax20 Firmware 1.1.6.34; NETGEAR Mr60 Firmware 1.1.6.124; NETGEAR Mr80 Firmware 1.1.6.14; NETGEAR Ms60 Firmware 1.1.6.124; NETGEAR Ms80 Firmware 1.1.6.14; NETGEAR R6400 Firmware 1.0.1.78, 1.0.4.126; NETGEAR R6700 1.0.4.126; NETGEAR R6900P Firmware 1.3.3.148; NETGEAR R7000 1.0.11.134; NETGEAR R7000P 1.3.3.148; NETGEAR R7100Lg Firmware 1.0.0.76. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-27647 or the next vulnerability affects your stack