CVE-2022-27643 is a critical vulnerability affecting NETGEAR R6700v3 1.0.4.120_10.0.91 routers, allowing unauthenticated, network-adjacent attackers to execute arbitrary code with root privileges. This buffer overflow flaw occurs during SOAP request processing due to improper validation of the SOAPAction header length. With a CVSS score of 8.8 (High), it presents a significant risk as it requires no authentication and has high impact on confidentiality, integrity, and availability. While no active exploitation or public exploit code is currently reported, and community discussion is minimal, the potential for remote code execution makes it a serious concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.0.1.78CPE matchmatch criteria | cpe:2.3:o:netgear:r6400_firmware:*:*:*:*:*:*:*:* | ||
< 1.0.4.126CPE matchmatch criteria | cpe:2.3:o:netgear:r6400_firmware:*:*:*:*:*:*:*:* | ||
< 1.0.4.126CPE matchmatch criteria | cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:* | ||
< 1.3.3.148CPE matchmatch criteria | cpe:2.3:o:netgear:r6900p_firmware:*:*:*:*:*:*:*:* | ||
< 1.0.11.134CPE matchmatch criteria | cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.