Sign-up

ID

VAR-202305-0156


CVE

CVE-2023-27358


TITLE

in multiple NETGEAR products.  SQL  Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2023-027804

DESCRIPTION

NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of specific SOAP requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-19754. RAX30 firmware, RAXE300 firmware, RAX40 For multiple Netgear products such as firmware, SQL There is an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. NETGEAR RAX30 is a dual-band wireless router from NETGEAR

Trust: 2.88

sources: NVD: CVE-2023-27358 // JVNDB: JVNDB-2023-027804 // ZDI: ZDI-23-502 // CNVD: CNVD-2024-33671 // VULMON: CVE-2023-27358

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-33671

AFFECTED PRODUCTS

vendor:netgearmodel:rax30scope: - version: -

Trust: 1.3

vendor:netgearmodel:rax40scope:ltversion:1.0.10.94

Trust: 1.0

vendor:netgearmodel:rax38scope:ltversion:1.0.10.94

Trust: 1.0

vendor:netgearmodel:rax30scope:ltversion:1.0.10.94

Trust: 1.0

vendor:netgearmodel:raxe300scope:ltversion:1.0.10.94

Trust: 1.0

vendor:netgearmodel:rax35scope:ltversion:1.0.10.94

Trust: 1.0

vendor:ネットギアmodel:rax35scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax30scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax38scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:raxe300scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax40scope: - version: -

Trust: 0.8

sources: ZDI: ZDI-23-502 // CNVD: CNVD-2024-33671 // JVNDB: JVNDB-2023-027804 // NVD: CVE-2023-27358

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2023-27358
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2023-27358
value: HIGH

Trust: 1.0

NVD: CVE-2023-27358
value: HIGH

Trust: 0.8

ZDI: CVE-2023-27358
value: HIGH

Trust: 0.7

CNVD: CNVD-2024-33671
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-33671
severity: HIGH
baseScore: 8.3
vectorString: AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 6.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2023-27358
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2023-27358
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2023-27358
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-502 // CNVD: CNVD-2024-33671 // JVNDB: JVNDB-2023-027804 // NVD: CVE-2023-27358 // NVD: CVE-2023-27358

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.0

problemtype:SQL injection (CWE-89) [ others ]

Trust: 0.8

problemtype:SQL injection (CWE-89) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-027804 // NVD: CVE-2023-27358

PATCH

title:NETGEAR has issued an update to correct this vulnerability.url:https://kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349

Trust: 0.7

title:Patch for NETGEAR RAX30 Remote Code Execution Vulnerability (CNVD-2024-33671)url:https://www.cnvd.org.cn/patchInfo/show/567916

Trust: 0.6

sources: ZDI: ZDI-23-502 // CNVD: CNVD-2024-33671

EXTERNAL IDS

db:NVDid:CVE-2023-27358

Trust: 4.0

db:ZDIid:ZDI-23-502

Trust: 2.6

db:JVNDBid:JVNDB-2023-027804

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-19754

Trust: 0.7

db:CNVDid:CNVD-2024-33671

Trust: 0.6

db:VULMONid:CVE-2023-27358

Trust: 0.1

sources: ZDI: ZDI-23-502 // CNVD: CNVD-2024-33671 // VULMON: CVE-2023-27358 // JVNDB: JVNDB-2023-027804 // NVD: CVE-2023-27358

REFERENCES

url:https://kb.netgear.com/000065617/security-advisory-for-authentication-bypass-on-some-routers-psv-2022-0349

Trust: 2.5

url:https://www.zerodayinitiative.com/advisories/zdi-23-502/

Trust: 1.9

url:https://nvd.nist.gov/vuln/detail/cve-2023-27358

Trust: 0.8

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2023-27358

Trust: 0.6

sources: ZDI: ZDI-23-502 // CNVD: CNVD-2024-33671 // VULMON: CVE-2023-27358 // JVNDB: JVNDB-2023-027804 // NVD: CVE-2023-27358

CREDITS

Interrupt Labs

Trust: 0.7

sources: ZDI: ZDI-23-502

SOURCES

db:ZDIid:ZDI-23-502
db:CNVDid:CNVD-2024-33671
db:VULMONid:CVE-2023-27358
db:JVNDBid:JVNDB-2023-027804
db:NVDid:CVE-2023-27358

LAST UPDATE DATE

2025-01-11T23:05:16.788000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-502date:2023-05-01T00:00:00
db:CNVDid:CNVD-2024-33671date:2024-07-26T00:00:00
db:JVNDBid:JVNDB-2023-027804date:2025-01-10T02:19:00
db:NVDid:CVE-2023-27358date:2025-01-09T15:37:04.203

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-502date:2023-05-01T00:00:00
db:CNVDid:CNVD-2024-33671date:2024-07-10T00:00:00
db:JVNDBid:JVNDB-2023-027804date:2025-01-10T00:00:00
db:NVDid:CVE-2023-27358date:2024-05-03T02:15:13.673