RCE in NETGEAR R6230
CVE-2022-40619
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq_access_token parameter. This affects R6230 before 1.1.0.112, R6260 before 1.1.0.88, R7000 before 1.0.11.134, R8900 before 1.0.5.42, R9000 before 1.0.5.42, and XR300 before 1.0.3.72 and Orbi RBR20 before 2.7.2.26, RBR50 before 2.7.4.26, RBS20 before 2.7.2.26, and RBS50 before 2.7.4.26.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.022 (81.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-40619?
- CVE-2022-40619 is a high-severity vulnerability in NETGEAR R6230, classified under Command Injection. CVSS score: 7.7/10. Published 2026-01-28.
- How severe is CVE-2022-40619?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2022-40619 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.