by Kastro
Paper/Archive/CVE-2023-33532

CVE-2023-33532

mitre — There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48.

EPSS 16%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.9.969 × 2019.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/D2y6p/CVE/blob/main/Netgear/CVE-2023-33532/Netgear_R6250_RCE.pdf