CVE-2023-28338: High severity Netgear RAX30 firmware vulnerability

Published Mar 15, 2023

Updated

Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body being written to “/tmp/mulipartFile” on the device itself. A sufficiently large file will cause device resources to be exhausted, resulting in the device becoming unusable until it is rebooted.

Affected Software

2 affected components

Netgear RAX30 firmware

Netgear RAX30

Event History

Mar 15, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2023-28338?

CVE-2023-28338 is a vulnerability in Netgear Nighthawk Wifi6 Router (RAX30) that allows an attacker to exhaust device resources by sending a request with a specific "Content-Type" header.

How does CVE-2023-28338 affect Netgear Rax30 Firmware?

CVE-2023-28338 affects Netgear Rax30 Firmware by allowing an attacker to write a large file to the device, depleting its resources.

What is the severity rating of CVE-2023-28338?

CVE-2023-28338 has a severity rating of 7.5, indicating a high severity.

How can I fix CVE-2023-28338?

There is currently no official fix or patch available for CVE-2023-28338. It is recommended to monitor for vendor updates and apply them as soon as they become available.

Where can I find more information about CVE-2023-28338?

You can find more information about CVE-2023-28338 at the following link: [CVE-2023-28338](https://drupal9.tenable.com/security/research/tra-2023-12).