CVE-2022-44198

Vulnerability

Netgear R7000P firmware version V1.3.1.64 contains a buffer overflow vulnerability in the handling of the openvpn_push1 parameter. The exact code path is not disclosed in available references, but the parameter is likely processed without proper bounds checking, leading to a stack or heap overflow.

Exploitation

No specific exploitation details are provided in the available references. An attacker would need to be able to send crafted input to the vulnerable parameter, possibly through the web interface or other network services. The required authentication level or network position is not specified.

Impact

Successful exploitation of the buffer overflow could result in memory corruption, potentially leading to denial of service or arbitrary code execution with the privileges of the affected process. The exact impact is not detailed in the references.

Mitigation

As of the publication date (2022-11-22), no official fix or workaround has been disclosed by NETGEAR. Users should monitor the vendor's security advisory page [1] for updates. The product may be end-of-life; check NETGEAR support for current status.