TLS Certificate Validation Vulnerability in NETGEAR Routers and Orbi WiFi Systems
CVE-2022-40620

7.7HIGH

Key Information:

Vendor

NETGEAR
Status
NETGEAR Routers and Orbi WiFi Systems
Vendor
CVE Published:
28 January 2026

What is CVE-2022-40620?

A vulnerability has been identified in FunJSQ, a third-party module integrated into certain NETGEAR routers and Orbi WiFi Systems. This issue arises from inadequate validation of TLS certificates during the downloading of update packages through the auto-update mechanism. An attacker positioned on the network may exploit this flaw by intercepting update requests, enabling them to deliver malicious update packages. Successfully exploiting this vulnerability can lead to arbitrary code execution on the affected devices, thereby compromising their security.

References

https://kb.netgear.com/000065132/Security-Advisory-for-Vu...
https://www.onekey.com/resource/security-advisory-netgear...

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.