CVE-2022-27647

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the name or email field provided to libreadycloud.so. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15874.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Mar 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-276487.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of KOYO Screen Creator 0.1.1.1. User interact CVE-2022-276497.5A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby CVE-2022-27659.8A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an CVE-2022-276507.5A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Do CVE-2022-276516.8A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker En CVE-2022-276525.3A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (CVE-2022-276537.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write pa CVE-2022-276546.5When a user opens a manipulated Photoshop Document (.psd, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - versi CVE-2022-276556.5When a user opens a manipulated Universal 3D (.u3d, 3difr.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version CVE-2022-276566.1The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled in CVE-2022-276572.7A highly privileged remote attacker, can gain unauthorized access to display contents of restricted directories by exploiting insufficient v CVE-2022-276587.5Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information