CVE-2022-27946: NETGEAR r8500 Firmware

High severity, CVSS 8.8. EPSS: 3.2% chance of exploitation in the next 30 days.

NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi.

Affected products

• NETGEAR r8500 Firmware: version 1.0.2.158 only

Published 2022-03-26. Last modified 2026-06-17.