CVE-2022-4873

PoC —

CVSS 3.1

9.8 critical

EPSS

7%p94

Published

Jan 11, 2023 (Jan 11, 2023)

Modified

Jun 17, 2026

Description

On Netcomm router models NF20MESH, NF20, and NL1902 a stack based buffer overflow affects the sessionKey parameter. By providing a specific number of bytes, the instruction pointer is able to be overwritten on the stack and crashes the application at a known location.

Vendors: netcommwireless
Products: nf20 firmware, nf20mesh firmware, nl1902 firmware
Weakness: CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (7.2%)

In the news4 stories

Week in review: Critical git vulnerabilities, increasingly malicious Google Search ads

Help Net SecurityJan 22, 00:00 UTC · Jan 22, 2023Vulnerability CVE-2022-46169 CVE-2022-47966 CVE-2022-4873+3 CVEs

Critical Security Vulnerabilities Discovered in Netcomm and TP

The Hacker NewsJan 18, 17:12 UTC · Jan 18, 2023Vulnerability CVE-2022-4873 CVE-2022-4874 CVE-2022-4499+1 CVEs

A couple of bugs can be chained to hack Netcomm routers

Security AffairsJan 18, 15:18 UTC · Jan 18, 2023Exploit / PoC CVE-2022-4873 CVE-2022-4874

Vulnerable NetComm routers and a public PoC exploit (CVE-2022-4873, CVE-2022-4874)

Help Net SecurityJan 18, 00:00 UTC · Jan 18, 2023Exploit / PoC CVE-2022-4873 CVE-2022-4874