CVEvulnerability

CVE-2022-47208

8.8 HIGH Published 2022-12-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78

Description

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.

Affected configurations

• netgear nighthawk ax1800 firmware (< 1.0.9.90) • netgear nighthawk ax2400 firmware (< 1.0.9.90) • netgear nighthawk ax3000 firmware (< 1.0.9.90) • netgear nighthawk ax5400 firmware (< 1.0.9.90) • netgear nighthawk ax6000 firmware (< 1.0.9.90) • netgear nighthawk ax11000 firmware (< 1.0.9.90)

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References