How to Fix 5 Vulnerabilities in NETGEAR RAX30 Router?

NETGEAR has addressed five vulnerabilities in the NETGEAR RAX30 Router model. These vulnerabilities in NETGEAR’s Nighthawk RAX30 allow attackers to monitor users’ internet activity, highjack internet connections, and redirect traffic to malicious websites or inject malware into network traffic when chained together. It’s important to know how to fix these 5 vulnerabilities in the NETGEAR RAX30 Router model at the earliest.

A Short Note About NETGEAR RAX30 Router Model

The NETGEAR RAX30 Router Model is a powerful WiFi 6 router that capable of delivering seamless 4K streaming to smart TVs, gaming consoles, and mobile devices with up to 2.4 Gbps wireless speeds. Equipped with a robust 1.5 GHz triple-core processor and three high-power antennas, this router ensures maximum wireless coverage for an improved WiFi experience. Additionally, NETGEAR Armor provides automatic protection for all connected devices, safeguarding against online threats.

Technical Specifications:

List Of Vulnerabilities In NETGEAR RAX30 Router

Team82 uncovered five vulnerabilities in NETGEAR RAX30 Router in a hacking competition ‘Pwn2Own Toronto hacking competition‘ held in Toronto in December 2022. Out of the five vulnerabilities three are categorized as high-severity vulnerabilities and two are medium. These flaws, if exploited successfully, could give threat actors unimpeded access to your digital life.

Let’s explore each one of them one after the other.

CVE-2023-27357: The Unauthenticated Information Disclosure Vulnerability

This flaw opens the door for attackers in proximity to the network to expose sensitive data on affected NETGEAR RAX30 routers. The most unsettling part? Authentication isn’t required for exploitation.

The root of the issue lies in the handling of SOAP (Simple Object Access Protocol) requests. The flaw emerges due to the absence of an authentication process before permitting access to functionalities. This loophole could allow an attacker to expose sensitive information, leading to further network compromise.

CVE-2023-27369: The Code Execution Vulnerability

This vulnerability provides network-adjacent attackers an opportunity to execute arbitrary code on affected installations of NETGEAR RAX30. Like the previous flaw, this one doesn’t require authentication for exploitation either.

The specific weakness resides within the ‘soap_serverd’ binary. When processing the request headers, the process fails to validate the length of user-supplied data before copying it to a fixed-length stack-based buffer. An attacker could exploit this flaw to bypass the system’s authentication.

CVE-2023-27368: The Authentication Bypass Vulnerability

This flaw allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers, bypassing authentication without any difficulty.

The flaw lies within the ‘soap_serverd’ binary. Similar to the previous vulnerability, the issue stems from the improper validation of user-supplied data length before copying it to a fixed-length stack-based buffer during the parsing of SOAP message headers. This vulnerability could be exploited by an attacker to bypass system authentication.

CVE-2023-27367: The Remote Code Execution Vulnerability

This vulnerability enables network-adjacent attackers to execute arbitrary code on affected NETGEAR RAX30 routers. Though exploitation of this vulnerability technically requires authentication, the existing authentication mechanism can be easily bypassed.

This specific flaw exists within the ‘libcms_cli’ module. The issue arises from the lack of proper validation of user-supplied commands before using them to execute a system call. By exploiting this flaw, an attacker could execute code in the context of root.