PT-2023-3271 · NetGear · Netgear Rax30

Dmitry Janushkevich + 1 · Published 2023-01-04 · Updated 2025-01-03 · CVE-2023-34284

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NETGEAR RAX30 (affected versions not specified)

Description This issue allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR RAX30 routers. The specific flaw exists within the system configuration, where a hardcoded user account can be used to access the CLI service as a low-privileged user. An attacker can leverage this vulnerability to bypass authentication on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2023-03394

CVE-2023-34284

ZDI-23-838

Affected Products

Netgear Rax30

References · 12

• https://zerodayinitiative.com/advisories/ZDI-23-838 · Security Note
• https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34284 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34284 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03394 · Security Note
• https://twitter.com/CVEnew/status/1787926491235500462 · Twitter Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-19660 · Note
• https://t.me/cvenotify/106187 · Telegram Post
• https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004 · Note
• https://cybersecurity-help.cz/vdb/SB2023031011 · Note
• https://twitter.com/VulmonFeeds/status/1786272713578783027 · Twitter Post
• https://vuldb.com/ru/?id.231146 · Note