CVE-2023-35721
📋 TL;DR
This vulnerability in NETGEAR routers allows network-adjacent attackers to exploit improper certificate validation in the HTTPS update functionality. Attackers can use this to compromise downloaded information and potentially execute arbitrary code as root without authentication. Affected users include anyone using vulnerable NETGEAR router models.
💻 Affected Systems
- NETGEAR RAX50
- Other NETGEAR router models with similar curl_post functionality
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges, allowing complete device compromise, data theft, and persistence on the network.
Likely Case
Man-in-the-middle attacks to deliver malicious firmware updates, potentially leading to device compromise or network infiltration.
If Mitigated
Limited to certificate validation bypass only if other attack vectors are blocked.
🎯 Exploit Status
Requires network adjacency and likely combination with other vulnerabilities for full RCE. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RAX50 firmware 1.0.2.88 or later
Vendor Advisory: https://kb.netgear.com/000065668/Security-Advisory-for-Improper-Remote-Server-Certificate-Validation-on-the-RAX50-PSV-2023-0019
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates. 4. If update available, download and install. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable automatic updates
allPrevent router from automatically checking for updates over vulnerable HTTPS connection
Network segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Replace affected router with patched model or different vendor
- Implement strict network access controls to limit who can communicate with router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under Advanced > Administration > Firmware UpdateCheck Version:
No CLI command - check via web interface at http://routerlogin.net or router IPVerify Fix Applied:
Confirm firmware version is 1.0.2.88 or later for RAX50, or check vendor advisory for other models📡 Detection & Monitoring
Log Indicators:
- Unusual firmware update attempts
- HTTPS connections to update servers with invalid certificates
Network Indicators:
- Man-in-the-middle activity between router and update servers
- Unusual outbound HTTPS traffic from router
SIEM Query:
source_ip=ROUTER_IP AND dest_port=443 AND (certificate_error OR ssl_handshake_failure)🔗 References
- https://kb.netgear.com/000065668/Security-Advisory-for-Improper-Remote-Server-Certificate-Validation-on-the-RAX50-PSV-2023-0019
- https://www.zerodayinitiative.com/advisories/ZDI-23-893/
- https://kb.netgear.com/000065668/Security-Advisory-for-Improper-Remote-Server-Certificate-Validation-on-the-RAX50-PSV-2023-0019
- https://www.zerodayinitiative.com/advisories/ZDI-23-893/
