Lucene search

ZdiCVE-2023-34284

HistoryMay 03, 2024 - 2:15 a.m.

CVE-2023-34284

2024-05-0302:15:27

CWE-798

zdi

web.nvd.nist.gov

cve-2023-34284

netgear rax30

hard-coded credentials

authentication bypass

vulnerability

network-adjacent attackers

cli service

low-privileged user

zdi-can-19660

nvd

CVSS3

6.3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the system configuration. The system contains a hardcoded user account which can be used to access the CLI service as a low-privileged user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19660.

Affected configurations

Vulners

Vulnrichment

Node

netgearrax30Range≤1.0.9.92

VendorProductVersionCPE
netgearrax30*cpe:2.3:a:netgear:rax30:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netgear	rax30	*	cpe:2.3:a:netgear:rax30::::::::

CNA Affected

[
  {
    "vendor": "NETGEAR",
    "product": "RAX30",
    "versions": [
      {
        "version": "1.0.9.92_1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650

www.zerodayinitiative.com/advisories/ZDI-23-838/

CVSS3

6.3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

16.2%

JSON

Related for CVE-2023-34284