CVE-2022-46424 Security feature bypass in n/a
Attackers can bypass firmware integrity checks via MITM to execute arbitrary code or cause denial of service on Netgear Powerline Access Points.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-46424?
CVE-2022-46424 is a high-severity vulnerability in n/a, published on 20 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Point. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a Denial of Service (DoS). This affects v0.4.1.1 and earlier.
Which versions are affected by CVE-2022-46424?
It affects 1 product.
Products include Netgear Xwn5001 Firmware.
How do I fix CVE-2022-46424?
No fix has been published for CVE-2022-46424 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-46424 being exploited?
There is no known exploitation of CVE-2022-46424 in the wild and no public exploit code.
Sources
Also known as GHSA-3gph-54h9-x2ff.