CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2023-27358

NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of specific SOAP requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-19754.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.008

EPSS Ranking 72.1%

CVSS Severity

CVSS v3 Score 8.8

References

Products affected by CVE-2023-27358

Netgear » Rax30 » Version: N/A

cpe:2.3:h:netgear:rax30:-
Netgear » Rax35 » Version: N/A

cpe:2.3:h:netgear:rax35:-
Netgear » Rax38 » Version: N/A

cpe:2.3:h:netgear:rax38:-
Netgear » Rax40 » Version: N/A

cpe:2.3:h:netgear:rax40:-
Netgear » Raxe300 » Version: N/A

cpe:2.3:h:netgear:raxe300:-
Netgear » Rax30 Firmware » Version: N/A

cpe:2.3:o:netgear:rax30_firmware:-
Netgear » Rax30 Firmware » Version: 1.0.3.64

cpe:2.3:o:netgear:rax30_firmware:1.0.3.64
Netgear » Rax30 Firmware » Version: 1.0.4.66

cpe:2.3:o:netgear:rax30_firmware:1.0.4.66
Netgear » Rax30 Firmware » Version: 1.0.5.70

cpe:2.3:o:netgear:rax30_firmware:1.0.5.70
Netgear » Rax30 Firmware » Version: 1.0.6.74

cpe:2.3:o:netgear:rax30_firmware:1.0.6.74
Netgear » Rax30 Firmware » Version: 1.0.7.78

cpe:2.3:o:netgear:rax30_firmware:1.0.7.78
Netgear » Rax30 Firmware » Version: 1.0.9.90

cpe:2.3:o:netgear:rax30_firmware:1.0.9.90
Netgear » Rax30 Firmware » Version: 1.0.9.92

cpe:2.3:o:netgear:rax30_firmware:1.0.9.92
Netgear » Rax35 Firmware » Version: N/A

cpe:2.3:o:netgear:rax35_firmware:-
Netgear » Rax35 Firmware » Version: 1.0.3.62

cpe:2.3:o:netgear:rax35_firmware:1.0.3.62
Netgear » Rax35 Firmware » Version: 1.0.3.80

cpe:2.3:o:netgear:rax35_firmware:1.0.3.80
Netgear » Rax35 Firmware » Version: 1.0.3.94

cpe:2.3:o:netgear:rax35_firmware:1.0.3.94
Netgear » Rax35 Firmware » Version: 1.0.4.102

cpe:2.3:o:netgear:rax35_firmware:1.0.4.102
Netgear » Rax38 Firmware » Version: N/A

cpe:2.3:o:netgear:rax38_firmware:-
Netgear » Rax38 Firmware » Version: 1.0.3.94

cpe:2.3:o:netgear:rax38_firmware:1.0.3.94
Netgear » Rax38 Firmware » Version: 1.0.4.102

cpe:2.3:o:netgear:rax38_firmware:1.0.4.102
Netgear » Rax40 Firmware » Version: N/A

cpe:2.3:o:netgear:rax40_firmware:-
Netgear » Rax40 Firmware » Version: 1.0.3.62

cpe:2.3:o:netgear:rax40_firmware:1.0.3.62
Netgear » Rax40 Firmware » Version: 1.0.3.64

cpe:2.3:o:netgear:rax40_firmware:1.0.3.64
Netgear » Rax40 Firmware » Version: 1.0.3.80

cpe:2.3:o:netgear:rax40_firmware:1.0.3.80
Netgear » Rax40 Firmware » Version: 1.0.3.94

cpe:2.3:o:netgear:rax40_firmware:1.0.3.94
Netgear » Rax40 Firmware » Version: 1.0.4.102

cpe:2.3:o:netgear:rax40_firmware:1.0.4.102
Netgear » Raxe300 Firmware » Version: N/A

cpe:2.3:o:netgear:raxe300_firmware:-
Netgear » Raxe300 Firmware » Version: 1.0.5.56

cpe:2.3:o:netgear:raxe300_firmware:1.0.5.56
Netgear » Raxe300 Firmware » Version: 1.0.7.62

cpe:2.3:o:netgear:raxe300_firmware:1.0.7.62
Netgear » Raxe300 Firmware » Version: 1.0.8.64

cpe:2.3:o:netgear:raxe300_firmware:1.0.8.64

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2023-27358

Products

Pricing

Contact Us