Command Injection Vulnerability in PuHTTPSniff Service Affects Router Devices
CVE-2022-47208

8.8HIGH

Key Information:

Vendor
Netgear
Status
NETGEAR Nighthawk WiFi6 Router
Vendor
CVE Published:
16 December 2022

Summary

The PuHTTPSniff service, which operates by default on certain routers, is vulnerable to command injection attacks due to insufficiently validated user input. This flaw allows attackers on the same network segment to execute arbitrary commands on the affected device without requiring authentication. This vulnerability poses a significant risk as it can lead to unauthorized access and control over network resources.

Affected Version(s)

NETGEAR Nighthawk WiFi6 Router NETGEAR Nighthawk WiFi6 Router prior to V1.0.9.90

References

https://www.tenable.com/security/research/tra-2022-37

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.