by Kastro
Paper/Archive/CVE-2022-37337

CVE-2022-37337

Netgear Orbi Router RBR750 — A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5.

EPSS 3%public exploitCVSS 9.1
critical.is priorityof 100
55
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 86.6.866 × 2017.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
Orbi Router RBR7504.6.8.5–CNA

Scores by source

talos (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2022-1596refkb.netgear.com/000065417/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0187reftalosintelligence.com/vulnerability_reports/TALOS-2022-1596