CVE-2022-27647

Vulnerability

CVE-2022-27647 is a command injection vulnerability in the libreadycloud.so library of NETGEAR R6700v3 routers running firmware version 1.0.4.120_10.0.91. The flaw exists when the router processes the name or email field, failing to properly validate a user-supplied string before using it in a system call. An attacker must have valid router credentials, but authentication can be bypassed [1][2].

Exploitation

The attacker must be on the same WiFi network (or have an Ethernet connection) and able to authenticate to the router. Once authenticated, the attacker sends a crafted request to the affected service that includes a malicious payload in the name or email field. The lack of input validation allows the payload to be passed directly to a system call, resulting in command execution [2].

Impact

A successful exploit allows the attacker to execute arbitrary commands with root privileges on the router. This leads to a full compromise of the device, including complete control over network traffic, data exfiltration, and the ability to pivot to other devices on the network [1][2].

Mitigation

NETGEAR released firmware version 1.0.4.126 to fix this vulnerability on the R6700v3. Users should update to the latest firmware via the router web interface or NETGEAR support page [1]. No workaround is available, and the vulnerability is not listed in CISA KEV.