CVE-2022-27645

HIGH

8.8

CVSS Score

Published: March 29, 2023 at 12:00 AM UTC

Updated: June 17, 2026 at 04:37 AM UTC

47 products affected across 1 vendorR6700 FirmwareR7000 FirmwareR8500 Firmware

Using R6700v3 by NETGEAR?

Get instant alerts when new vulnerabilities affect R6700v3 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 1%

SSVC

No known exploit

Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloud_control.cgi. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15762.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

LAX20 Firmware · NETGEAR

95%

v < 1.1.6.34

Affected range stops below 1.1.6.34, so it looks safe — our inference, not a vendor statement

netgear-lax20 (same device)

R6400 Firmware · NETGEAR

95%

v < 1.0.4.126

Affected range stops below 1.0.4.126, so it looks safe — our inference, not a vendor statement

R6700 Firmware · NETGEAR

95%

v < 1.0.4.126

Affected range stops below 1.0.4.126, so it looks safe — our inference, not a vendor statement

netgear-r6700 (same device)

R7000 Firmware · NETGEAR

95%

v < 1.0.11.134

Affected range stops below 1.0.11.134, so it looks safe — our inference, not a vendor statement

netgear-r7000 (same device)

R7850 Firmware · NETGEAR

95%

v < 1.0.5.84

Affected range stops below 1.0.5.84, so it looks safe — our inference, not a vendor statement

netgear-r7850 (same device)

R7900P Firmware · NETGEAR

95%

v < 1.4.3.88

Affected range stops below 1.4.3.88, so it looks safe — our inference, not a vendor statement

netgear-r7900p (same device)

R7960P Firmware · NETGEAR

95%

v < 1.4.3.88

Affected range stops below 1.4.3.88, so it looks safe — our inference, not a vendor statement

netgear-r7960p (same device)

R8000 Firmware · NETGEAR

95%

v < 1.0.4.84

Affected range stops below 1.0.4.84, so it looks safe — our inference, not a vendor statement

netgear-r8000 (same device)

R8000P Firmware · NETGEAR

95%

v < 1.4.3.88

Affected range stops below 1.4.3.88, so it looks safe — our inference, not a vendor statement

netgear-r8000p (same device)

R8500 Firmware · NETGEAR

95%

v < 1.0.2.158

Affected range stops below 1.0.2.158, so it looks safe — our inference, not a vendor statement

netgear-r8500 (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://kb.netgear.com/000064722/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-Fixed-Wireless-Products-PSV-2021-0325

References (2)

Vendor Advisory

Source: [email protected]

https://kb.netgear.com/000064722/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-Fixed-Wireless-Products-PSV-2021-0325

Third Party AdvisoryVDB Entry

Source: [email protected]

https://www.zerodayinitiative.com/advisories/ZDI-22-522/

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGH[email protected]

Attack Vector: ADJACENT_NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-306CWE-697

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card