NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability
CVE-2023-27360

8.8HIGH

Key Information:

Vendor
Netgear
Status
Rax30
Vendor
CVE Published:
3 May 2024

Summary

The NETGEAR RAX30 is susceptible to a vulnerability originating from a misconfiguration in the lighttpd HTTP server, which permits execution of files sourced from untrusted entities. This flaw enables network-adjacent attackers to execute arbitrary code, potentially gaining root-level access on affected installations without requiring any form of authentication. Proper evaluation and timely patching are essential to mitigate the risks associated with this vulnerability.

Affected Version(s)

RAX30 1.0.6.74_1

References

https://www.zerodayinitiative.com/advisories/ZDI-23-496/
x_research-advisory
https://kb.netgear.com/000065559/Security-Advisory-for-Mu...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.