CVE-2022-27946

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/donothingme/VUL/blob/main/vul3/3.mdExploit, Patch, Third Party Advisory
https://github.com/donothingme/VUL/blob/main/vul3/3.mdExploit, Patch, Third Party Advisory

Timeline

Published: Mar 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-279478.8NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in CVE-2022-279484.3Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of a CVE-2022-279497.5A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not exe CVE-2022-27955.3By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effective CVE-2022-279505.5In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition.CVE-2022-279529.8An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a craf CVE-2022-279585.4Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers to access and arbitra CVE-2022-27964.8Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.CVE-2022-279605.4Insecure permissions configured in the user_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitraril CVE-2022-279615.4A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML CVE-2022-279629.8Bluecms 1.6 has a SQL injection vulnerability at cooike.CVE-2022-279636.5Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.