CVE-2023-34283
📋 TL;DR
This vulnerability allows physically present attackers to access arbitrary files on NETGEAR RAX30 routers by exploiting improper symbolic link handling on USB media. Attackers can read sensitive system files without authentication, potentially exposing credentials and configuration data. Only users with physical access to the router and ability to insert USB media are affected.
💻 Affected Systems
- NETGEAR RAX30
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains root-level access to sensitive system files including configuration, credentials, and potentially private keys, leading to complete router compromise.
Likely Case
Attacker reads router configuration files, obtains administrative credentials, and potentially gains persistent access to the network.
If Mitigated
With proper physical security controls, impact is limited as attacker needs physical access to router and USB port.
🎯 Exploit Status
Exploitation requires creating a symbolic link on USB media and inserting it into router. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.0.10.94
Vendor Advisory: https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install V1.0.10.94. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable USB Sharing
allDisable USB media sharing functionality to prevent symbolic link exploitation.
Physical Security Controls
allRestrict physical access to router and USB ports using locked enclosures or secure locations.
🧯 If You Can't Patch
- Disable USB sharing functionality in router settings
- Implement strict physical security controls around router location
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is below V1.0.10.94, system is vulnerable.Check Version:
Login to router admin interface and check firmware version under Advanced > Administration > Firmware UpdateVerify Fix Applied:
Verify firmware version is V1.0.10.94 or higher in router admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual USB device connections
- Multiple failed file access attempts via web interface
Network Indicators:
- Unusual administrative access patterns
SIEM Query:
Look for USB device insertion events followed by web server file access attempts🔗 References
- https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650
- https://www.zerodayinitiative.com/advisories/ZDI-23-837/
- https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650
- https://www.zerodayinitiative.com/advisories/ZDI-23-837/
