CVE-2023-33532
9.8
CRITICAL · CVSS 3.1 · EPSS 16.2% (pctl 97)
Patch early
EPSS 16.2% — above the 10% action threshold.
Description
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 16.17% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-77 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2023-06-06 |
| Last modified | 2026-07-09 |
Affected (2)
| Vendor | Product |
|---|---|
| netgear | r6250 |
| netgear | r6250 firmware |
References
→ the Explorer · watch your stack · NVD