CVE-2023-27368
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code on NETGEAR RAX30 routers without authentication. Attackers can exploit a stack-based buffer overflow in the soap_serverd binary to bypass authentication and gain control of affected devices. Only NETGEAR RAX30 router users are affected.
💻 Affected Systems
- NETGEAR RAX30
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and use the router as part of a botnet.
Likely Case
Router takeover enabling traffic interception, DNS hijacking, credential theft, and lateral movement to connected devices.
If Mitigated
Limited impact with proper network segmentation and monitoring, though router functionality could still be disrupted.
🎯 Exploit Status
No public PoC available but technical details are published. Exploitation requires network adjacency but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.0.10.94
Vendor Advisory: https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install V1.0.10.94 or later. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable SOAP service
allDisable the vulnerable soap_serverd service if not required
Network segmentation
allIsolate router management interface to trusted VLAN
🧯 If You Can't Patch
- Replace affected router with patched model
- Implement strict network access controls to limit LAN-side access to router
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under Advanced > Administration > Firmware UpdateCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Confirm firmware version is V1.0.10.94 or later in admin interface📡 Detection & Monitoring
Log Indicators:
- Unusual SOAP requests to router
- Multiple failed authentication attempts followed by successful access
- Unexpected process crashes in router logs
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains from router
- Unexpected traffic redirection
SIEM Query:
source="router_logs" AND ("soap_serverd" OR "buffer overflow" OR "authentication bypass")🔗 References
- https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348
- https://www.zerodayinitiative.com/advisories/ZDI-23-499/
- https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348
- https://www.zerodayinitiative.com/advisories/ZDI-23-499/
