NETGEAR RAX30 rex_cgi JSON Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-27361

Summary

A specific vulnerability exists in the NETGEAR RAX30 routers that stems from improper handling of JSON data. This flaw allows network-adjacent attackers to execute arbitrary code on affected systems due to inadequate validation of user-supplied data length. The vulnerability particularly targets the stack-based buffer, where an attacker can exploit this issue to execute code with root privileges on the device. Authentication is a prerequisite for the compromise, making it essential for users to ensure that their devices are shielded against unauthorized access.

References