PT-2023-4237 · NetGear · Netgear Wag302V2

Published 2023-07-15 · Updated 2023-08-09 · CVE-2023-38921

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netgear WG302v2 version 5.2.9 Netgear WAG302v2 version 5.1.19

Description The issue is related to command injection vulnerabilities in the upgrade handler function. These vulnerabilities can be exploited via the firmwareRestore and firmwareServerip parameters, potentially allowing a remote attacker to execute arbitrary commands.

Recommendations For Netgear WG302v2 version 5.2.9, consider disabling the upgrade handler function until a patch is available. For Netgear WAG302v2 version 5.1.19, restrict access to the parameters firmwareRestore and firmwareServerip to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-04552

CVE-2023-38921

Affected Products

Netgear Wag302V2

References · 7

• https://osv.dev/vulnerability/CVE-2023-38921 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04552 · Security Note
• https://netgear.com/about/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38921 · Security Note
• https://github.com/FirmRec/IoT-Vulns/tree/main/netgear/upgrade_handler · Note
• https://github.com/advisories/GHSA-2jj3-h6g5-p92f · Note
• https://t.me/cvenotify/55947 · Telegram Post