CVE-2022-27642
This vulnerability allows network-adjacent attackers to bypass authentication on affected...
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-15854.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-15854.
- Record
CVE-2022-27642- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2022-32143
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-15854.
- Record
EUVD-2022-32143- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w94x-h737-f6h9
This vulnerability allows network-adjacent attackers to bypass authentication on affected...
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-15854.
- Record
GHSA-w94x-h737-f6h9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-15854.
- Record
CVE-2022-27642- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
- netgear r6700v3
- netgear cax80 firmware
- netgear lax20 firmware
- netgear mr60 firmware
- netgear mr80 firmware
- netgear ms60 firmware
- netgear ms80 firmware
- netgear r6400 firmware
- netgear r6700 firmware
- netgear r6900p firmware
- netgear r7000 firmware
- netgear r7000p firmware
Show 22 moreShow less
- netgear r7100lg firmware
- netgear r7850 firmware
- netgear r7900p firmware
- netgear r7960p firmware
- netgear r8000 firmware
- netgear r8000p firmware
- netgear r8500 firmware
- netgear rax15 firmware
- netgear rax200 firmware
- netgear rax20 firmware
- netgear rax35 firmware
- netgear rax38 firmware
- netgear rax40 firmware
- netgear rax42 firmware
- netgear rax43 firmware
- netgear rax45 firmware
- netgear rax48 firmware
- netgear rax50 firmware
- netgear rax50s firmware
- netgear rax75 firmware
- netgear rax80 firmware
- netgear rs400 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-27642 is a medium vulnerability (CVSS 6.3) in Netgear R6700v3, published March 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. No source names a fixed version.