PT-2023-2726 · NetGear · Netgear Rax30

Noam Moshe + 3 · Published 2023-01-24 · Updated 2025-01-03 · CVE-2023-27357

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR RAX30 (affected versions not specified)

Description This issue allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. The specific flaw exists within the handling of SOAP requests, resulting from the lack of authentication prior to allowing access to functionality. An attacker can leverage this to disclose sensitive information, leading to further compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-200

Related Identifiers

BDU:2023-02571

CVE-2023-27357

ZDI-23-497

Affected Products

Netgear Rax30

References · 9

• https://zerodayinitiative.com/advisories/ZDI-23-497 · Security Note
• https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02571 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27357 · Security Note
• https://t.me/cvenotify/106193 · Telegram Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-19608 · Note
• https://t.me/true_secator/4373 · Telegram Post
• https://vuldb.com/ru/?id.227830 · Note