CVE-2023-27358
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute SQL injection via unauthenticated SOAP requests on NETGEAR RAX30 routers, potentially leading to remote code execution. Attackers can exploit this without authentication to compromise the router. All users of affected NETGEAR RAX30 routers are at risk.
💻 Affected Systems
- NETGEAR RAX30
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to intercept all network traffic, install persistent malware, pivot to internal network devices, and use router as attack platform.
Likely Case
Router compromise leading to credential theft, DNS hijacking, man-in-the-middle attacks, and network disruption.
If Mitigated
Limited impact with proper network segmentation and monitoring, though router remains vulnerable to adjacent attackers.
🎯 Exploit Status
Exploitation requires network adjacency but no authentication. Multiple public PoCs exist demonstrating SQL injection and RCE chain.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.0.10.94 or later
Vendor Advisory: https://kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install V1.0.10.94 or later. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable SOAP services
allDisable SOAP/UPnP services if not required
Network segmentation
allIsolate router management interface from user networks
🧯 If You Can't Patch
- Replace router with patched model or different vendor
- Implement strict network access controls to limit adjacent network access
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is below V1.0.10.94, system is vulnerable.Check Version:
Check via router web interface at Advanced > Administration > Firmware UpdateVerify Fix Applied:
Confirm firmware version is V1.0.10.94 or higher in router admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual SOAP request patterns
- SQL error messages in logs
- Unexpected process execution
Network Indicators:
- Unusual SOAP traffic to router management interface
- SQL injection patterns in HTTP requests
SIEM Query:
source="router_logs" AND ("SOAP" OR "sql" OR "injection") AND dest_ip="router_ip"🔗 References
- https://kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349
- https://www.zerodayinitiative.com/advisories/ZDI-23-502/
- https://kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349
- https://www.zerodayinitiative.com/advisories/ZDI-23-502/
