CVE-2023-27360: NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability
NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the configuration of the lighttpd HTTP server. The issue results from allowing execution of files from untrusted sources. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19398.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27360?
CVE-2023-27360 is a critical severity vulnerability that allows remote code execution without authentication.
How do I fix CVE-2023-27360?
To fix CVE-2023-27360, update the NETGEAR RAX30 firmware to the latest version released by NETGEAR.
Who is affected by CVE-2023-27360?
CVE-2023-27360 affects users of the NETGEAR RAX30 with firmware versions prior to 1.0.10.94.
Can CVE-2023-27360 be exploited remotely?
Yes, CVE-2023-27360 can be exploited by network-adjacent attackers without the need for authentication.
What are the potential impacts of CVE-2023-27360?
Exploitation of CVE-2023-27360 could allow attackers to execute arbitrary code on the affected NETGEAR RAX30 installations.