TI-2022-10813 Aliases CVE-2022-27945 GHSA-9729-7gh5-v22r

NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary…

MEDIUM 43CWE-78Published 2022-03-26 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi.

Why it matters now

EPSS 0.02945 87th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:netgear:r8500_firmware:1.0.2.158:::::::*	1.0.2.158	Vulnerable	NETGEAR
cpe:2.3:h:netgear:r8500:-:::::::*	not specified by NVD	Running on	NETGEAR

cpe:2.3:o:netgear:r8500_firmware:1.0.2.158:*:*:*:*:*:*:* Versions 1.0.2.158 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:r8500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-27945
2026-10-03 Alias added: GHSA-9729-7gh5-v22r

References

Exploit 1

https://github.com/donothingme/VUL/blob/main/vul2/2.md

TI-2024-34909 Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were… CVSS 3.1HIGH 8.0
TI-2024-34908 Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in… CVSS 3.1HIGH 8.0
TI-2024-34907 Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in… CVSS 3.1HIGH 8.0
TI-2024-34906 Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in… CVSS 3.1HIGH 8.0
TI-2024-34198 Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were… CVSS 3.1HIGH 8.0
TI-2024-34197 Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in… CVSS 3.1HIGH 8.0

See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences