NETGEAR RAX30 soap_serverd Stack-based Buffer Overflow Authentication Bypass Vulnerability

CVE-2023-27369

What is CVE-2023-27369?

A vulnerability exists in the soap_serverd binary of the NETGEAR RAX30, allowing network-adjacent attackers to exploit the system due to improper validation of user-supplied data lengths. This flaw enables attackers to bypass necessary authentication mechanisms, which could lead to arbitrary code execution on affected installations. The vulnerability arises when the application inaccurately processes incoming request headers, resulting in a stack-based buffer overflow. As a consequence, unauthorized users may gain access to sensitive functions without the need for valid credentials.

References