CVE-2023-27357: (Pwn2Own) NETGEAR RAX30 GetInfo Missing Authentication Information Disclosure Vulnerability
First published: Fri May 03 2024(Updated: )
NETGEAR RAX30 GetInfo Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose sensitive information, leading to further compromise. Was ZDI-CAN-19608.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netgear RAX30 | ||
| All of | ||
| NETGEAR RAX30 firmware | <1.0.10.94 | |
| Netgear RAX30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-27357?
The severity of CVE-2023-27357 is considered high due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2023-27357?
To mitigate CVE-2023-27357, upgrade the NETGEAR RAX30 firmware to version 1.0.10.94 or later.
Who is affected by CVE-2023-27357?
CVE-2023-27357 affects installations of NETGEAR RAX30 routers running vulnerable firmware versions.
What type of vulnerability is CVE-2023-27357?
CVE-2023-27357 is an information disclosure vulnerability that allows network-adjacent attackers to access sensitive data.
Is authentication required to exploit CVE-2023-27357?
No, authentication is not required to exploit CVE-2023-27357, making it more dangerous for affected users.
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-23-497
- alias/ZDI-CAN-19608
- alias/CVE-2023-27357
- agent/software-canonical-lookup
- agent/title
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- vendor/netgear
- canonical/netgear rax30
- canonical/netgear rax30 firmware