CVE-2023-27358
Estado: AnalizadaAlta (8.8)—
NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of specific SOAP requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-19754.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.88%
- Percentil entre todas las CVEs puntuadas: 58
- Fecha de la puntuación: 4/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (5)
CWE
- CWE-89
- CWE-89
Referencias
- https://kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349
- https://www.zerodayinitiative.com/advisories/ZDI-23-502/
- https://kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349
- https://www.zerodayinitiative.com/advisories/ZDI-23-502/
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-27358",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-27358",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-06-06T15:39:54.731083Z"
}
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "zdi-disclosures@trendmicro.com",
"affectedData": [
{
"vendor": "NETGEAR",
"product": "RAX30",
"versions": [
{
"status": "affected",
"version": "1.0.9.90_3"
}
],
"defaultStatus": "unknown"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:h:netgear:rax30_firmware:*:*:*:*:*:*:*:*"
],
"vendor": "netgear",
"product": "rax30_firmware",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.0.10.94",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:h:netgear:rax35_firmware:*:*:*:*:*:*:*:*"
],
"vendor": "netgear",
"product": "rax35_firmware",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.0.10.94",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:h:netgear:rax38_firmware:*:*:*:*:*:*:*:*"
],
"vendor": "netgear",
"product": "rax38_firmware",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.0.10.94",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:h:netgear:rax40_firmware:*:*:*:*:*:*:*:*"
],
"vendor": "netgear",
"product": "rax40_firmware",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.0.10.94",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:h:netgear:raxe300_firmware:*:*:*:*:*:*:*:*"
],
"vendor": "netgear",
"product": "raxe300_firmware",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.0.10.94",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-05-03T02:15:13.673",
"references": [
{
"url": "https://kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349",
"tags": [
"Vendor Advisory"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-502/",
"tags": [
"Third Party Advisory"
],
"source": "zdi-disclosures@trendmicro.com"
},
{
"url": "https://kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-502/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of specific SOAP requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-19754."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecución remota de código de inyección SQL de solicitud SOAP de NETGEAR RAX30. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en instalaciones afectadas de enrutadores NETGEAR RAX30. No se requiere autenticación para aprovechar esta vulnerabilidad. La falla específica existe en el manejo de solicitudes SOAP específicas. El problema se debe a la falta de validación adecuada de una cadena proporcionada por el usuario antes de usarla para construir consultas SQL. Un atacante puede aprovechar esto junto con otras vulnerabilidades para ejecutar código arbitrario en el contexto de la cuenta de servicio. Era ZDI-CAN-19754."
}
],
"lastModified": "2026-06-17T05:44:52.000",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94C6B573-5355-47EE-A262-E15AE88F8DDB",
"versionEndExcluding": "1.0.10.94"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EBC92B49-60E0-4554-BE7F-D2B5D6EF6454"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0FFB9D62-BB6B-4706-876C-1056F659D4A2",
"versionEndExcluding": "1.0.10.94"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:raxe300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BD3BE955-696E-41D6-B281-1473EC803803"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:rax40_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D340B311-1788-43BB-BD13-6AABCA720A25",
"versionEndExcluding": "1.0.10.94"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:rax40:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "13D54346-4B03-4296-B050-04EB8CFCA732"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:rax35_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C30EEA0B-BB23-4860-AD57-DCD7EFBAE7DC",
"versionEndExcluding": "1.0.10.94"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:rax35:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4201E4D6-4DDF-4EF3-902A-960DFFF7C9A4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:netgear:rax38_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97647327-6F08-40B8-8F48-04681E494676",
"versionEndExcluding": "1.0.10.94"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:netgear:rax38:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BDA02FAE-E0C9-402F-9E7D-69EEDCC80053"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "zdi-disclosures@trendmicro.com"
}