Login Request a demo
High severity · published Jan 28, 2026
CVE-2022-40619
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices
7.7
CVSS
2.5%
EPSS
No
On KEV
Description
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsq_access_token parameter. This affects R6230 before 1.1.0.112, R6260 before 1.1.0.88, R7000 before 1.0.11.134, R8900 before 1.0.5.42, R9000 before 1.0.5.42, and XR300 before 1.0.3.72 and Orbi RBR20 before 2.7.2.26, RBR50 before 2.7.4.26, RBS20 before 2.7.2.26, and RBS50 before 2.7.4.26.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
R6230 Firmware · Netgear
before 1.1.0.112 · source: NVD
RF
R6260 Firmware · Netgear
before 1.1.0.88 · source: NVD
RF
R7000 Firmware · Netgear
before 1.0.11.134 · source: NVD
RF
R8900 Firmware · Netgear
before 1.0.5.42 · source: NVD
RF
R9000 Firmware · Netgear
before 1.0.5.42 · source: NVD
RF
Rax120 Firmware · Netgear
before 1.2.8.40 · source: NVD
RF
Rax120v2 Firmware · Netgear
before 1.2.8.40 · source: NVD
RF
Rbr20 Firmware · Netgear
before 2.7.2.26 · source: NVD
RF
Rbs20 Firmware · Netgear
before 2.7.2.26 · source: NVD
XF
Xr300 Firmware · Netgear
before 1.0.3.72 · source: NVD
Affected product
RF
R6230 Firmware
Netgear
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-40619
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-40619
Vendor Advisory
https://kb.netgear.com/000065132/Security-Advisory-for-Vulnerabilities-in-FunJSQ-on-Some-Routers-and-Orbi-WiFi-Systems-PSV-2022-0117
Exploit
https://www.onekey.com/resource/security-advisory-netgear-routers-funjsq-vulnerabilities
More from R6230 Firmware
9.8
CVE-2021-45644
Certain NETGEAR devices are affected by incorrect configuration of security settings
9.8
CVE-2021-45511
Certain NETGEAR devices are affected by authentication bypass
9.8
CVE-2021-45501
Certain NETGEAR devices are affected by authentication bypass
9.8
CVE-2021-38516
Certain NETGEAR devices are affected by lack of access control at the function level
9.8
CVE-2020-35799
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker