CVE-2023-40478
📋 TL;DR
This vulnerability allows network-adjacent attackers to execute arbitrary code as root on NETGEAR RAX30 routers by exploiting a stack-based buffer overflow in the telnet CLI service. Although authentication is required, the existing mechanism can be bypassed. Affected users are those with NETGEAR RAX30 routers running vulnerable firmware.
💻 Affected Systems
- NETGEAR RAX30
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full router compromise with root-level remote code execution, allowing attacker to intercept traffic, modify configurations, install persistent malware, or pivot to internal networks.
Likely Case
Router takeover leading to man-in-the-middle attacks, DNS hijacking, credential theft, and network disruption.
If Mitigated
Limited impact if telnet is disabled and proper network segmentation prevents adjacent network access.
🎯 Exploit Status
Exploitation requires network adjacency and bypassing authentication, but detailed technical analysis is publicly available from ZDI.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.0.11.96
Vendor Advisory: https://kb.netgear.com/000065649/Security-Advisory-for-Post-authentication-Buffer-Overflow-on-the-RAX30-PSV-2023-0002
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install V1.0.11.96 or later. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable Telnet Service
allCompletely disable the telnet CLI service to prevent exploitation.
telnet disable
Restrict Network Access
allUse firewall rules to block access to port 23 from untrusted networks.
🧯 If You Can't Patch
- Disable telnet service immediately via router CLI or web interface
- Implement strict network segmentation to isolate router from untrusted devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Advanced > Administration > Firmware Update. If version is below V1.0.11.96, system is vulnerable.Check Version:
show version (via telnet/SSH) or check web interfaceVerify Fix Applied:
Confirm firmware version is V1.0.11.96 or later and verify telnet service is disabled or patched.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts on telnet port 23
- Unusual telnet connections from internal IPs
- Buffer overflow patterns in telnet logs
Network Indicators:
- Unusual traffic to port 23 from internal sources
- Telnet connections with abnormal payload sizes
SIEM Query:
source_port=23 AND (event_type="authentication_failure" OR payload_size>1024)🔗 References
- https://kb.netgear.com/000065649/Security-Advisory-for-Post-authentication-Buffer-Overflow-on-the-RAX30-PSV-2023-0002
- https://www.zerodayinitiative.com/advisories/ZDI-23-1163/
- https://kb.netgear.com/000065649/Security-Advisory-for-Post-authentication-Buffer-Overflow-on-the-RAX30-PSV-2023-0002
- https://www.zerodayinitiative.com/advisories/ZDI-23-1163/
