CVE-2022-4873

On Netcomm router models NF20MESH, NF20, and NL1902 a stack based buffer overflow affects the sessionKey parameter. By providing a specific number of bytes, the instruction pointer is able to be overwritten on the stack and crashes the application at a known location.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cret@cert.org

Published

2023-01-11

Last modified

2025-11-04

Weaknesses

CWE-787

Affected products

• Nf20 (Netcomm)
• Nf20mesh (Netcomm)
• Nl1902 (Netcomm)
• Nf20 Firmware (Netcommwireless)
• Nf20mesh Firmware (Netcommwireless)
• Nl1902 Firmware (Netcommwireless)

References

• https://github.com/scarvell/advisories/blob/main/2022_netcomm_nf20mesh_unauth_rce.md
• https://www.kb.cert.org/vuls/id/986018