Vulnerability Details : CVE-2023-27370
NETGEAR RAX30 Device Configuration Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the handling of device configuration. The issue results from the storage of configuration secrets in plaintext. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19841.
Vulnerability category: Information leak
Products affected by CVE-2023-27370
- cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-27370
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 16 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-27370
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.7
|
MEDIUM | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.1
|
3.6
|
Zero Day Initiative | 2024-05-03 |
5.7
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.1
|
3.6
|
NIST | 2025-01-03 |
CWE ids for CVE-2023-27370
-
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.Assigned by:
- nvd@nist.gov (Primary)
- zdi-disclosures@trendmicro.com (Secondary)
References for CVE-2023-27370
-
https://kb.netgear.com/000065619/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2022-0348
Security Advisory for Multiple Vulnerabilities on the RAX30, PSV-2022-0348 - NETGEAR SupportVendor Advisory
-
https://www.zerodayinitiative.com/advisories/ZDI-23-501/
ZDI-23-501 | Zero Day InitiativeThird Party Advisory
Jump to