dbcve.org
Ax2400 FirmwareOperating system · Netgear

CVE-2022-4390

CRITICAL · 10.0 CVSS v3.1 Published 2022-12-09
Fix available
A fix is available. Upgrade to 1.0.9.90 or later.
See remediation →
100/100
Remediation priority · Urgent
Public exploit Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The NETGEAR RAX30 AX2400 router has IPv6 enabled on the WAN interface by default in versions prior to 1.0.9.90. While IPv4 traffic to the WAN is restricted by firewall rules, these same restrictions are not applied to IPv6 traffic. This exposes services like SSH (port 22) and Telnet (port 23) that should only be accessible from the local network, allowing remote attackers to interact with these services directly via the public IPv6 address.

MitigationUpdate router firmware to version 1.0.9.90 or later, which contains the fix for this misconfiguration. If unable to update immediately, disable IPv6 on the WAN interface as a workaround.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Ax2400 FirmwareOperating system
Affected:< 1.0.9.90

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify router model
    Access the router admin panel (typically at 192.168.1.1) or check the device label to confirm the model is NETGEAR RAX30 AX2400.
    Affected if Device is not a NETGEAR RAX30 AX2400 router.
  2. Check firmware version
    In the router admin panel, navigate to Administration > Firmware Update or Advanced > Administration > Router Update to view the current firmware version.
    Affected if Firmware version is lower than 1.0.9.90.
  3. Verify IPv6 WAN status
    In the router admin panel, go to Advanced > Advanced Setup > IPv6 to confirm whether IPv6 is enabled on the WAN interface.
    Affected if IPv6 is enabled on the WAN interface.
  4. Test SSH accessibility via IPv6
    Obtain the public IPv6 address of the router (using an online IPv6 test from behind the router or checking the router status page), then attempt to connect to port 22 using this IPv6 address from an external network or IPv6-enabled system.
    Affected if SSH (port 22) is reachable over public IPv6.
  5. Test Telnet accessibility via IPv6
    Using the router's public IPv6 address, attempt to connect to port 23 from an external network or IPv6-enabled system.
    Affected if Telnet (port 23) is reachable over public IPv6.

A user is affected if they have a NETGEAR RAX30 AX2400 router running firmware below 1.0.9.90 with IPv6 enabled on the WAN, and SSH or Telnet services are accessible from the public IPv6 address.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 1.0.9.90 or later
Fixed in 1.0.9.90
Vendor patch www.synacktiv.com →
Interim mitigation

Update router firmware to version 1.0.9.90 or later, which contains the fix for this misconfiguration. If unable to update immediately, disable IPv6 on the WAN interface as a workaround.

Recommended fix High confidence

1.0.9.90 or later

  1. Download firmware version 1.0.9.90 or later for the NETGEAR RAX30 AX2400 from NETGEAR's official support website
  2. Access the router's web interface by navigating to routerlogin.net or the router's IP address
  3. Log in with administrator credentials
  4. Navigate to the firmware update section (typically under Administration > Firmware Update)
  5. Upload the downloaded firmware file and initiate the update
  6. Wait for the router to reboot and verify the update was successful
  7. After updating, confirm that IPv6 firewall rules are now properly applied to the WAN interface if IPv6 is still enabled

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Ax2400 Firmware Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing3.0 h
  • Review / QA2.0 h
9.0 hours of engineering $1,570
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,512.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-4390 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-4390 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data