CVE-2022-46423 File upload in n/a
Attackers can modify firmware images via MITM to bypass checks, enabling arbitrary code execution or denial of service on Netgear routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-46423?
CVE-2022-46423 is a high-severity vulnerability in Netgear Wnr2000 Firmware, published on 20 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a Denial of Service (DoS). This affects v1.2.3.7 and earlier.
Weakness: CWE-494
Which versions are affected by CVE-2022-46423?
It affects 1 product.
Products include Netgear Wnr2000 Firmware.
How do I fix CVE-2022-46423?
No fix has been published for CVE-2022-46423 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-46423 being exploited?
There is no known exploitation of CVE-2022-46423 in the wild and no public exploit code.
Other vulnerabilities in Netgear Wnr2000 Firmware
Sources
Also known as GHSA-6662-6w2g-g564.