CVE-2023-33532
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
A command injection vulnerability exists in the Netgear R6250 router with Firmware Version 1.0.4.48. An attacker with web management privileges can inject commands into POST request parameters, thereby gaining shell access.
Risk Assessment
The risk involves potential full compromise of the router by an attacker with administrative privileges, which could lead to local network security breaches, traffic interception, or further attacks.
Recommendation
It is recommended to immediately update the router firmware to the latest available version and restrict access to the management interface to trusted IP addresses only.
Original NVD description (English source)
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can inject commands into the post request parameters, thereby gaining shell privileges.