CVE-2022-27642

Vulnerability

This authentication bypass vulnerability affects NETGEAR R6700v3 routers running firmware version 1.0.4.120_10.0.91 and possibly other models. The flaw resides in the httpd service and results from incorrect string matching logic when evaluating access to protected pages. An attacker does not require authentication to exploit this vulnerability. NETGEAR has released fixes for numerous models including R6700v3 (firmware version 1.0.4.126) as part of advisory PSV-2021-0327 [1][2].

Exploitation

An attacker must be network-adjacent (e.g., on the same WiFi network or connected via Ethernet) and does not need any credentials. The specific steps involve sending crafted HTTP requests that exploit the weak string-matching check in the httpd service, thereby bypassing the authentication mechanism for protected pages [1][2].

Impact

Successful exploitation allows the attacker to bypass authentication and access otherwise protected administrative interfaces or resources. The advisory states that this can be leveraged in conjunction with other vulnerabilities to achieve code execution in the context of root, leading to full compromise of the router [1][2].

Mitigation

NETGEAR has released fixed firmware version 1.0.4.126 for the R6700v3 on 2022-03-17. Users should upgrade via the router's administration interface. The fix addresses the string matching flaw. For other affected models, refer to NETGEAR's advisory PSV-2021-0327 for the appropriate fixed firmware version [1][2].