Netgear RAX30 AX2400 1.0.6.74 IPv6 access control

Summaryinfo

A vulnerability was found in Netgear RAX30 AX2400. It has been declared as critical. Impacted is an unknown function of the component IPv6 Handler. Executing a manipulation can lead to access control. This vulnerability is tracked as CVE-2022-4390. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Netgear RAX30 AX2400 (Wireless LAN Software). It has been declared as critical. This vulnerability affects some unknown processing of the component IPv6 Handler. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network.

The weakness was disclosed 12/10/2022 by Firewall. The advisory is available at synacktiv.com. This vulnerability was named CVE-2022-4390 since 12/09/2022. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/14/2025). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 1.0.9.90 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• RAX30 AX2400

Version

• 1.0.6.74

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion