CVE-2023-27360
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code as root on NETGEAR RAX30 routers without authentication, due to a misconfiguration in the lighttpd HTTP server that permits execution of untrusted files. It affects users of NETGEAR RAX30 routers with vulnerable firmware versions.
💻 Affected Systems
- NETGEAR RAX30
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full root control over the router, enabling them to intercept traffic, deploy malware, or pivot to other network devices.
Likely Case
Attackers exploit the vulnerability to install backdoors, steal credentials, or launch attacks on internal network resources.
If Mitigated
With proper patching and network segmentation, the impact is limited to isolated network segments, preventing broader compromise.
🎯 Exploit Status
Exploitation is straightforward for network-adjacent attackers due to the lack of authentication requirements and misconfiguration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 1.0.10.94 or later
Vendor Advisory: https://kb.netgear.com/000065559/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0352
Restart Required: Yes
Instructions:
1. Log into the NETGEAR RAX30 router admin interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install firmware version 1.0.10.94 or later. 4. Reboot the router after installation.
🔧 Temporary Workarounds
Disable Remote Management
allTurn off remote management features to reduce attack surface from network-adjacent threats.
Log into router admin, go to Advanced > Administration > Remote Management, set to 'Turn Off'
Network Segmentation
allIsolate the router on a separate VLAN to limit lateral movement in case of compromise.
Configure VLANs on your network switch or firewall to segment router traffic
🧯 If You Can't Patch
- Disconnect the router from untrusted networks and restrict access to trusted devices only.
- Monitor network traffic for unusual activity and implement strict firewall rules to block unauthorized access attempts.
🔍 How to Verify
Check if Vulnerable:
Check the firmware version in the router admin interface under Advanced > Administration > Firmware Update; if version is below 1.0.10.94, it is vulnerable.Check Version:
Log into router admin and navigate to Advanced > Administration > Firmware Update to view current version.Verify Fix Applied:
After updating, confirm the firmware version is 1.0.10.94 or higher in the same admin section.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to lighttpd server, unexpected file executions, or root privilege escalations in system logs.
Network Indicators:
- Suspicious traffic patterns to router management ports, such as port 80/443 from unauthorized internal IPs.
SIEM Query:
Example: 'source="router_logs" AND (event="file_execution" OR event="root_access")'🔗 References
- https://kb.netgear.com/000065559/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0352
- https://www.zerodayinitiative.com/advisories/ZDI-23-496/
- https://kb.netgear.com/000065559/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0352
- https://www.zerodayinitiative.com/advisories/ZDI-23-496/
