CVE-2022-40619: FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This…

high7.7CVSS 3.1

AVNACHPRNUINSUCHIHAL

FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq_access_token parameter. This affects R6230 before 1.1.0.112, R6260 before 1.1.0.88, R7000 before 1.0.11.134, R8900 before 1.0.5.42, R9000 before 1.0.5.42, and XR300 before 1.0.3.72 and Orbi RBR20 before 2.7.2.26, RBR50 before 2.7.4.26, RBS20 before 2.7.2.26, and RBS50 before 2.7.4.26.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
netgear	r6230_firmware	< 1.1.0.112	1.1.0.112
netgear	r6260_firmware	< 1.1.0.88	1.1.0.88
netgear	r7000_firmware	< 1.0.11.134	1.0.11.134
netgear	r8900_firmware	< 1.0.5.42	1.0.5.42
netgear	r9000_firmware	< 1.0.5.42	1.0.5.42
netgear	rax120_firmware	< 1.2.8.40	1.2.8.40
netgear	rax120v2_firmware	< 1.2.8.40	1.2.8.40
netgear	rbr20_firmware	< 2.7.2.26	2.7.2.26
netgear	rbs20_firmware	< 2.7.2.26	2.7.2.26
netgear	xr300_firmware	< 1.0.3.72	1.0.3.72

CVSS provenance

nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

vulncheck7.7HIGH