High severity8.8NVD Advisory· Published May 3, 2024· Updated Jun 17, 2026

CVE-2023-27358

Description

NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of specific SOAP requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-19754.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Netgear/Rax30 Firmware
cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*
Range: <1.0.10.94
Netgear/Rax35 Firmware
cpe:2.3:o:netgear:rax35_firmware:*:*:*:*:*:*:*:*
Range: <1.0.10.94
Netgear/Rax38 Firmware
cpe:2.3:o:netgear:rax38_firmware:*:*:*:*:*:*:*:*
Range: <1.0.10.94
Netgear/Rax40 Firmware
cpe:2.3:o:netgear:rax40_firmware:*:*:*:*:*:*:*:*
Range: <1.0.10.94
Netgear/Raxe300 Firmware
cpe:2.3:o:netgear:raxe300_firmware:*:*:*:*:*:*:*:*
Range: <1.0.10.94
Netgear/RAX30llm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 1.0.9.90_3

Patches

Vulnerability mechanics

References

kb.netgear.com/000065617/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2022-0349nvdVendor Advisory
www.zerodayinitiative.com/advisories/ZDI-23-502/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000