Netgear RAX30 Firmware Image forceFWUpdate unrestricted upload

Summaryinfo

A vulnerability was found in Netgear RAX30. It has been rated as very critical. Affected is an unknown function of the component Firmware Image Handler. Performing a manipulation of the argument forceFWUpdate results in unrestricted upload. This vulnerability is reported as CVE-2023-28337. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Netgear RAX30 (Wireless LAN Software) (version unknown). This affects an unknown function of the component Firmware Image Handler. The manipulation of the argument forceFWUpdate with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force the upgrade to complete and bypass certain validation checks. End users can use this to upload modified, unofficial, and potentially malicious firmware to the device.

The weakness was disclosed 03/16/2023. It is possible to read the advisory at drupal9.tenable.com. This vulnerability is uniquely identified as CVE-2023-28337 since 03/14/2023. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 12/05/2025). The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-32035). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• RAX30

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion