RCE in NETGEAR R6230
CVE-2022-40619
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq_access_token parameter. This affects R6230 before 1.1.0.112, R6260 before 1.1.0.88, R7000 before 1.0.11.134, R8900 before 1.0.5.42, R9000 before 1.0.5.42, and XR300 before 1.0.3.72 and Orbi RBR20 before 2.7.2.26, RBR50 before 2.7.4.26, RBS20 before 2.7.2.26, and RBS50 before 2.7.4.26.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.025 (84.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.023 · newest: 0.025 · change: +0.003
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- kb.netgear.com/000065132/Security-Advisory-for-Vulnerabilities-in-FunJSQ-on-Som… (Vendor Advisory)
- www.onekey.com/resource/security-advisory-netgear-routers-funjsq-vulnerabilities (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-40619?
- CVE-2022-40619 is a high-severity vulnerability in NETGEAR R6230, classified under Command Injection. CVSS score: 7.7/10. Published 2026-01-28.
- How severe is CVE-2022-40619?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2022-40619 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.