CVE-2022-36429

HIGH

Netgear Orbi Satellite RBS750 4.6.8.5 - Command Injection

Title source: llm

Description

A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.

References (3)

[Various Sources] https://kb.netgear.com/000065424/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0188

[Exploit, Third Party Advisory] https://talosintelligence.com/vulnerability_reports/TALOS-2022-1597

[Third Party Advisory] https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1597

Scores

CVSS v3 7.2

EPSS 0.0050

EPSS Percentile 66.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-912

Status published

Products (1)

netgear/rbs750_firmware 4.6.8.5

Published Mar 21, 2023

Tracked Since Feb 18, 2026