NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12_10.1.11 and R6300_V2 firmware versions through R6300v2-V1.0.4.52_10.0.93 allow remote authenticated attackers to execute arbitrary command via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameters.
References
| Link | Resource |
|---|---|
| http://r6200v2.com | Broken Link URL Repurposed |
| https://github.com/10TG/vulnerabilities/blob/main/Netgear/CVE-2022-30078/CVE-2022-30078.md | Exploit Third Party Advisory |
| https://www.netgear.com/about/security/ | Vendor Advisory |
Configurations
History
14 Feb 2024, 01:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://r6200v2.com - Broken Link, URL Repurposed |
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 |
12 Sep 2022, 18:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.netgear.com/about/security/ - Vendor Advisory | |
| References | (MISC) http://r6200v2.com - Broken Link | |
| References | (MISC) https://github.com/10TG/vulnerabilities/blob/main/Netgear/CVE-2022-30078/CVE-2022-30078.md - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:o:netgear:r6200_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:netgear:r6300_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:netgear:r6300:v2:*:*:*:*:*:*:* cpe:2.3:h:netgear:r6200:v2:*:*:*:*:*:*:* |
|
| First Time |
Netgear r6200 Firmware
Netgear r6300 Netgear Netgear r6200 Netgear r6300 Firmware |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-77 |
07 Sep 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-07 19:15
Updated : 2024-02-14 01:17
NVD link : CVE-2022-30078
Mitre link : CVE-2022-30078
CVE.ORG link : CVE-2022-30078
JSON object : View
Products Affected
netgear
- r6300_firmware
- r6200
- r6300
- r6200_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')