CVE-2022-44194: n/a buffer overflow

CISO Take

This is an unauthenticated, network-reachable buffer overflow in the Netgear R7000P router's web admin interface, triggered through the apmode_dns1_pri and apmode_dns1_sec configuration parameters, and it carries a critical CVSS 9.8 requiring no privileges or user interaction. Despite the severity score, this record is consumer/SOHO router firmware, not an AI/ML software package, model, framework, or pipeline component — its 'ai_tool' tagging in our system appears to be a misclassification, and it maps to none of our tracked AI packages or architectures. Real-world exploitation pressure is low: EPSS places it in only the top 32% of CVEs by exploitation likelihood, it is absent from CISA KEV, no public exploit code or Nuclei scanner template exists, and CISA's own SSVC decision is TRACK_STAR, its lowest-priority monitoring tier. If your org runs R7000P devices as general network gear, apply the latest Netgear firmware and disable WAN-facing admin access as routine hygiene; do not route this into AI/ML risk registers or compliance evidence packs, since it has no bearing on model, agent, or inference-layer security.

Sources: NVD EPSS CISA KEV netgear.com

What is the risk?

CVSS-driven severity is critical (9.8, network/low-complexity/no-auth/no-UI, full C/I/A impact), but exploitation signals are weak: EPSS top-32% only, no CISA KEV listing, no public PoC or Nuclei template, and CISA SSVC scored it TRACK_STAR (lowest urgency tier, monitor-only). Net risk is best characterized as high theoretical severity with low current exploitation pressure — worth patching on a normal cadence, not an emergency.

How does the attack unfold?

Initial Access

Attacker reaches the R7000P's web management interface over the network, either locally or via exposed remote administration.

Exploitation

Attacker sends an oversized apmode_dns1_pri or apmode_dns1_sec value, overflowing a fixed-size buffer in the firmware request handler.

Impact

Overflow crashes the device (DoS) or, if exploited further, enables arbitrary code execution and persistent control of the router.

Initial Access

Attacker reaches the R7000P's web management interface over the network, either locally or via exposed remote administration.

Exploitation

Attacker sends an oversized apmode_dns1_pri or apmode_dns1_sec value, overflowing a fixed-size buffer in the firmware request handler.

Impact

Overflow crashes the device (DoS) or, if exploited further, enables arbitrary code execution and persistent control of the router.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.3%

chance of exploitation in 30 days

Higher than 69% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Check installed firmware version on any R7000P units and apply the latest Netgear firmware release (consult netgear.com/about/security/ for the current patched build). 2) Disable remote/WAN-facing router administration if not strictly required. 3) Restrict access to the local management interface (LAN-only, admin VLAN, or firewall ACL). 4) Since no public exploit or scanner signature exists yet, standard network IDS/IPS signatures for anomalous buffer-length payloads to admin-interface DNS parameters would be the only proactive detection option — no vendor-published IOC exists as of this writing.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution DoS Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2022-44194?

This is an unauthenticated, network-reachable buffer overflow in the Netgear R7000P router's web admin interface, triggered through the apmode_dns1_pri and apmode_dns1_sec configuration parameters, and it carries a critical CVSS 9.8 requiring no privileges or user interaction. Despite the severity score, this record is consumer/SOHO router firmware, not an AI/ML software package, model, framework, or pipeline component — its 'ai_tool' tagging in our system appears to be a misclassification, and it maps to none of our tracked AI packages or architectures. Real-world exploitation pressure is low: EPSS places it in only the top 32% of CVEs by exploitation likelihood, it is absent from CISA KEV, no public exploit code or Nuclei scanner template exists, and CISA's own SSVC decision is TRACK_STAR, its lowest-priority monitoring tier. If your org runs R7000P devices as general network gear, apply the latest Netgear firmware and disable WAN-facing admin access as routine hygiene; do not route this into AI/ML risk registers or compliance evidence packs, since it has no bearing on model, agent, or inference-layer security.

Is CVE-2022-44194 actively exploited?

No confirmed active exploitation of CVE-2022-44194 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-44194?

1) Check installed firmware version on any R7000P units and apply the latest Netgear firmware release (consult netgear.com/about/security/ for the current patched build). 2) Disable remote/WAN-facing router administration if not strictly required. 3) Restrict access to the local management interface (LAN-only, admin VLAN, or firewall ACL). 4) Since no public exploit or scanner signature exists yet, standard network IDS/IPS signatures for anomalous buffer-length payloads to admin-interface DNS parameters would be the only proactive detection option — no vendor-published IOC exists as of this writing.

What is the CVSS score for CVE-2022-44194?

CVE-2022-44194 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.34%.

What are the technical details?

Original Advisory

Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec.

Exploitation Scenario

An attacker with network access to the router's web management interface (LAN-adjacent, or WAN if remote management is enabled) submits an oversized value in the apmode_dns1_pri or apmode_dns1_sec parameter, overflowing a fixed-size buffer in the firmware's request handler. Depending on memory layout, this could crash the device (denial of service) or, in a worst case, allow the attacker to redirect execution flow toward arbitrary code execution on the router, granting persistent control over LAN traffic. This is a classic embedded-firmware memory-corruption bug with no AI/ML-specific attack chain.