Security readout for executives and security teams
Plain-English summary
This flaw affects specific Netcomm router models running firmware R6B025. A network-reachable attacker can abuse the sessionKey handling path to corrupt memory and potentially take control or crash the device. Because routers sit at network boundaries, confirmed exposure should be treated as urgent.
Executive priority
Prioritize discovery and exposure reduction now. A critical unauthenticated network flaw in boundary routers can create direct operational and security risk, especially if management surfaces are externally reachable. Patch or replacement guidance should come from the vendor or CERT/CC sources.
Technical view
CVE-2022-4873 is a stack-based buffer overflow in the sessionKey parameter on Netcomm NF20, NF20MESH, and NL1902 firmware R6B025. The CVSS 3.1 score is 9.8: network attack vector, low complexity, no privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Organizations using Netcomm NF20, NF20MESH, or NL1902 routers with firmware R6B025 are in scope. Risk is highest where the affected management or web interface is reachable from untrusted networks or the internet. The bundle does not identify other models or firmware versions as affected.
Exploitation context
The source bundle does not show CISA KEV listing or confirm active exploitation. The public advisory reference describes unauthenticated remote-code-execution context, while the CVE description confirms instruction-pointer overwrite and application crash at a known location. Treat this as high-risk even without verified exploitation.
Researcher notes
Evidence supports a stack overflow in sessionKey with instruction-pointer overwrite. Do not assume a universal fix or broader affected set beyond the listed models and firmware. The advisory title indicates unauthenticated RCE, but the supplied CVE text only describes overwrite and crash behavior.
Mitigation direction
- Inventory Netcomm NF20, NF20MESH, and NL1902 routers and confirm firmware versions.
- Restrict router management access to trusted administrative networks only.
- Check Netcomm, CERT/CC, and the advisory for firmware update or replacement guidance.
- Monitor affected routers for unexplained crashes, reboots, or management-interface anomalies.
Validation and detection
- Compare deployed router models and firmware against the affected R6B025 entries.
- Confirm whether management interfaces are reachable from internet or guest networks.
- Review device logs and uptime history for unexpected crashes or restarts.
- Track vendor and CERT/CC updates for remediation status and affected-version clarification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-4873 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/scarvell/advisories/blob/main/2022_netcomm_nf20mesh_unauth_rce.mdCVE reference
- https://www.kb.cert.org/vuls/id/986018CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.