CVE-2022-29383: NETGEAR ProSafe SSL VPN SQL injection in platform.cgi

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, unauthenticated access, public exploit code, and high EPSS make this a top remediation priority despite no KEV listing.

What it is

NETGEAR ProSafe SSL VPN firmware (FVS336Gv2 and FVS336Gv3) contains a SQL injection flaw reached through the USERDBDomains.Domainname parameter in cgi-bin/platform.cgi. The vulnerability is rated critical (CVSS 9.8) and sits in an internet-facing VPN appliance, so successful exploitation could expose or alter backend data. The record does not state which firmware versions are fixed or whether the endpoint is pre-authentication beyond the CVSS vector.

Impact

An attacker can inject SQL through the Domainname parameter, potentially reading, modifying, or deleting database contents and, depending on database privileges, executing further commands. Given the appliance role, this could undermine authentication and configuration data for the VPN service.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), so the cgi-bin/platform.cgi endpoint is exposed to unauthenticated remote requests. The description does not confirm whether the vulnerable parameter is reachable before login, so treat the pre-auth path as likely but unverified.

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.485, ~98.8th percentile) and public exploit code is referenced on GitHub, indicating meaningful real-world exploitation risk. No ransomware group usage is documented in the record.

What to do

• Apply the latest NETGEAR ProSafe SSL VPN firmware for FVS336Gv2/FVS336Gv3 per the vendor security advisory; the record does not name a fixed version, so confirm with NETGEAR.
• If the device is end-of-support or no patch is available, retire or replace it and remove it from internet exposure.
• Restrict management and VPN portal access to trusted networks or a VPN/allowlist rather than exposing cgi-bin/platform.cgi publicly.
• Deploy a WAF or reverse proxy rule to block SQL metacharacters and anomalous requests to cgi-bin/platform.cgi.
• Rotate any credentials or secrets stored on or managed by the appliance if compromise is suspected.

Detection

• Monitor web logs for requests to cgi-bin/platform.cgi with SQL syntax in the USERDBDomains.Domainname parameter (quotes, UNION, SELECT, comment markers).
• Alert on unusual HTTP response sizes, errors, or timing from platform.cgi that suggest SQL error leakage or blind injection.
• Baseline normal access to the SSL VPN portal and flag new source IPs or user agents hitting platform.cgi.
• Review appliance and database logs for unexpected queries or configuration changes originating from the VPN management interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.