Firmware Modification Vulnerability in Netgear WPN824EXT WiFi Range Extender
CVE-2022-38955

7.5HIGH

Key Information:

Vendor

Netgear
Status
WPn824ext Firmware
Vendor
CVE Published:
20 September 2022

What is CVE-2022-38955?

A vulnerability has been identified in the Netgear WPN824EXT WiFi Range Extender allowing attackers to exploit firmware modifications. By conducting a Man-in-the-Middle (MITM) attack, the attacker can manipulate the user-uploaded firmware image, circumventing the CRC checks. This exploitation potentially enables the introduction of a backdoor, granting unauthorized access to the device, or can lead to a Denial of Service (DoS) condition, rendering the extender inoperable. Ensuring device security and firmware integrity is crucial to mitigating such vulnerabilities.

References

https://www.netgear.com/about/security/
x_refsource_MISC
https://hackmd.io/%40eupX2KdkT6iNpqJUWk9p4A/SyAnOSd1s
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.