CVE-2023-27357: (Pwn2Own) NETGEAR RAX30 GetInfo Missing Authentication Information Disclosure Vulnerability
NETGEAR RAX30 GetInfo Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of SOAP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose sensitive information, leading to further compromise. Was ZDI-CAN-19608.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27357?
The severity of CVE-2023-27357 is considered high due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2023-27357?
To mitigate CVE-2023-27357, upgrade the NETGEAR RAX30 firmware to version 1.0.10.94 or later.
Who is affected by CVE-2023-27357?
CVE-2023-27357 affects installations of NETGEAR RAX30 routers running vulnerable firmware versions.
What type of vulnerability is CVE-2023-27357?
CVE-2023-27357 is an information disclosure vulnerability that allows network-adjacent attackers to access sensitive data.
Is authentication required to exploit CVE-2023-27357?
No, authentication is not required to exploit CVE-2023-27357, making it more dangerous for affected users.