Security readout for executives and security teams
Plain-English summary
CVE-2022-30078 is an authenticated command-execution flaw in older NETGEAR R6200v2 and R6300v2 router firmware. A logged-in attacker could cause the router to run unintended operating-system commands through IPv6 configuration handling. Business urgency depends on whether these legacy routers remain deployed and who can reach their administration interface.
Executive priority
Treat this as a high-priority asset hygiene issue if affected routers remain in service. Authenticated router command execution can become a serious foothold, but urgency is lower where devices are absent, patched, isolated, or retired.
Technical view
The CVE describes remote authenticated command injection via shell metacharacters in ipv6_fix.cgi IPv6 address or length parameters. Affected versions are R6200v2 through R6200v2-V1.0.3.12_10.1.11 and R6300v2 through R6300v2-V1.0.4.52_10.0.93. Public metadata does not provide CVSS, CWE, or a confirmed fixed version.
Likely exposure
Exposure is likely limited to environments still running the named NETGEAR R6200v2 or R6300v2 firmware, especially where router administration is reachable by untrusted users or reused credentials. The sources do not establish broad internet exposure.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. Exploitation requires authentication, but successful compromise would affect a network edge device with high trust and traffic visibility.
Researcher notes
Evidence supports authenticated command injection in ipv6_fix.cgi IPv6 parameters. The public CVE record lacks scoring and weakness classification, and the bundle does not identify a vendor patch level. Avoid assuming unauthenticated exploitation or active exploitation without additional evidence.
Mitigation direction
- Inventory R6200v2 and R6300v2 routers and record firmware versions.
- Check NETGEAR security guidance for fixed firmware or retirement direction.
- Restrict router administration to trusted management networks only.
- Disable remote administration where it is not operationally required.
- Rotate router administrator credentials if exposure is suspected.
- Replace unsupported or unpatchable affected devices.
Validation and detection
- Confirm whether any deployed router matches the affected models and versions.
- Verify administrative interfaces are not reachable from untrusted networks.
- Review NETGEAR guidance for an applicable fixed firmware version.
- Inspect router configuration for unexpected IPv6 or administrator changes.
- Check logs for unusual authenticated administrative activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-30078 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.netgear.com/about/security/CVE reference, mitre
- https://github.com/10TG/vulnerabilities/blob/main/Netgear/CVE-2022-30078/CVE-2022-30078.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.