CVE-2022-40619
Last modified
CVE-2022-40619 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq_access_token parameter. EPSS estimates a 2.23% chance of exploitation in the next 30 days.
Description
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq_access_token parameter. This affects R6230 before 1.1.0.112, R6260 before 1.1.0.88, R7000 before 1.0.11.134, R8900 before 1.0.5.42, R9000 before 1.0.5.42, and XR300 before 1.0.3.72 and Orbi RBR20 before 2.7.2.26, RBR50 before 2.7.4.26, RBS20 before 2.7.2.26, and RBS50 before 2.7.4.26.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Netgear | Rbr20 Firmware | < 2.7.2.26 |
| Netgear | R6230 Firmware | < 1.1.0.112 |
| Netgear | R6260 Firmware | < 1.1.0.88 |
| Netgear | R7000 Firmware | < 1.0.11.134 |
| Netgear | R8900 Firmware | < 1.0.5.42 |
| Netgear | R9000 Firmware | < 1.0.5.42 |
| Netgear | Rax120 Firmware | < 1.2.8.40 |
| Netgear | Rax120v2 Firmware | < 1.2.8.40 |
| Netgear | Xr300 Firmware | < 1.0.3.72 |
| Netgear | Rbs20 Firmware | < 2.7.2.26 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2022-40619?
How severe is CVE-2022-40619?
How do I fix CVE-2022-40619?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-40608IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft F…7.5
- CVE-2022-40609IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could …9.8
- CVE-2022-4061The JobBoardWP WordPress plugin before 1.2.2 does not proper…7.5
- CVE-2022-40615 IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1…9.8
- CVE-2022-40616IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 co…8.1
- CVE-2022-40617strongSwan before 5.9.8 allows remote attackers to cause a d…7.5
- CVE-2022-4062A CWE-285: Improper Authorization vulnerability exists that …7.8
- CVE-2022-40620FunJSQ, a third-party module integrated on some NETGEAR rout…7.7
- CVE-2022-40621Because the WAVLINK Quantum D4G (WN531G3) running firmware v…7.5
- CVE-2022-40622The WAVLINK Quantum D4G (WN531G3) running firmware version M…8.8
- CVE-2022-40623The WAVLINK Quantum D4G (WN531G3) running firmware version M…8.8
- CVE-2022-40624pfSense pfBlockerNG through 2.1.4_27 allows remote attackers…9.8
Are you affected by CVE-2022-40619?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST