Resource Exhaustion Vulnerability in Netgear Nighthawk Wifi6 Router

CVE-2023-28338

What is CVE-2023-28338?

A vulnerability in the Netgear Nighthawk Wifi6 Router (RAX30) allows attackers to exploit the device's web service by sending specially crafted requests. When the request includes a 'Content-Type' header with 'multipartboundary=', the device writes the request body to '/tmp/mulipartFile'. If an attacker sends a sufficiently large file, it can deplete the router's resources, rendering the device unresponsive until it is manually rebooted. This poses a significant risk to network reliability and accessibility for users.

References