NETGEAR RAX30 libcms_cli Command Injection Remote Code Execution Vulnerability

CVE-2023-27367

What is CVE-2023-27367?

This vulnerability affects NETGEAR RAX30 routers, allowing network-adjacent attackers to execute arbitrary code through a command injection flaw in the libcms_cli module. The security mechanism intended to protect against such exploits can be bypassed, enabling unauthorized command execution. The root context is compromised due to insufficient validation of user-provided commands used for system calls, creating a potential gateway for attackers to escalate privileges and manipulate the router. For detailed information, refer to the advisory provided by the vendor.

References