10 - CVE-2022-4390

Executive Summary

Informations
Name	CVE-2022-4390	First vendor Publication	2022-12-09
Vendor	Cve	Last vendor Modification	2023-11-07

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Overall CVSS Score	10
Base Score	10	Environmental Score	10
impact SubScore	6	Temporal Score	10
Exploitabality Sub Score	3.9

Attack Vector	Network	Attack Complexity	Low
Privileges Required	None	User Interaction	None
Scope	Changed	Confidentiality Impact	High
Integrity Impact	High	Availability Impact	High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4390

CPE : Common Platform Enumeration

Type	Description	Count
Os	Netgear Ax2400 Firmware cpe:2.3:o:netgear:ax2400_firmware::::::::	1

Sources (Detail)

https://www.tenable.com/security/research/tra-2022-36%2C

Source	Url
MISC	https://www.synacktiv.com/en/publications/cool-vulns-dont-live-long-netgear-a...

Alert History

If you want to see full details history, please login or register.

Date	Informations
2023-11-07 21:30:59	Multiple Updates
2023-08-09 17:27:49	Multiple Updates
2022-12-19 17:27:22	Multiple Updates
2022-12-10 09:27:13	Multiple Updates
2022-12-10 00:27:13	First insertion