CVE-2023-40479
📋 TL;DR
This vulnerability allows attackers on the same local network to execute arbitrary commands with root privileges on NETGEAR RAX30 routers without authentication. The flaw exists in the UPnP service due to improper input validation when processing user-supplied strings for system calls. Only NETGEAR RAX30 router users are affected.
💻 Affected Systems
- NETGEAR RAX30
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to intercept all network traffic, install persistent malware, pivot to other devices, or brick the router.
Likely Case
Router takeover enabling DNS hijacking, credential theft from connected devices, or botnet recruitment.
If Mitigated
No impact if router is patched or UPnP is disabled on isolated networks.
🎯 Exploit Status
Exploit code has been published and requires minimal technical skill to execute on the local network.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.0.10.94 or later
Vendor Advisory: https://kb.netgear.com/000065645/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0360-PSV-2022-0361
Restart Required: Yes
Instructions:
1. Log into router admin interface (typically 192.168.1.1 or routerlogin.net). 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install V1.0.10.94 or later. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable UPnP
allTurn off Universal Plug and Play service to prevent exploitation
Network Segmentation
allIsolate router management interface from untrusted devices
🧯 If You Can't Patch
- Disable UPnP immediately in router settings
- Implement strict network segmentation and firewall rules to limit LAN access
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under Advanced > Administration > Firmware Update. If version is below V1.0.10.94, you are vulnerable.Check Version:
No CLI command - check via web interface at 192.168.1.1 or routerlogin.netVerify Fix Applied:
Confirm firmware version is V1.0.10.94 or higher in router admin interface.📡 Detection & Monitoring
Log Indicators:
- Unusual UPnP service activity
- Unexpected system command execution in router logs
- Multiple failed UPnP requests from single internal IP
Network Indicators:
- Malformed UPnP requests to router on port 1900/udp or 5000/tcp
- Unusual outbound connections from router after UPnP activity
SIEM Query:
source="router" AND (process="upnp" OR port=1900 OR port=5000) AND (command="*" OR shell="*")🔗 References
- https://kb.netgear.com/000065645/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0360-PSV-2022-0361
- https://www.zerodayinitiative.com/advisories/ZDI-23-1161/
- https://kb.netgear.com/000065645/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0360-PSV-2022-0361
- https://www.zerodayinitiative.com/advisories/ZDI-23-1161/
