CVE-2023-34284

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-34284
NETGEAR RAX30 Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the system configuration. The system contains a hardcoded user account which can be used to access the CLI service as a low-privileged user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19660.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-838/ Third Party Advisory
https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-838/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*
History

03 Jan 2025, 17:03

Type Values Removed Values Added
References () https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650 - () https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650 - Vendor Advisory
References () https://www.zerodayinitiative.com/advisories/ZDI-23-838/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-838/ - Third Party Advisory
First Time Netgear rax30 Firmware
Netgear rax30
Netgear
CPE cpe:2.3:o:netgear:rax30_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax30:-:*:*:*:*:*:*:*

21 Nov 2024, 08:06

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de omisión de autenticación de credenciales codificadas en NETGEAR RAX30. Esta vulnerabilidad permite a atacantes adyacentes a la red eludir la autenticación en las instalaciones afectadas de los enrutadores NETGEAR RAX30. No se requiere autenticación para aprovechar esta vulnerabilidad. La falla específica existe dentro de la configuración del sistema. El sistema contiene una cuenta de usuario codificada que se puede utilizar para acceder al servicio CLI como usuario con pocos privilegios. Un atacante puede aprovechar esta vulnerabilidad para eludir la autenticación en el sistema. Era ZDI-CAN-19660.
References () https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650 - () https://kb.netgear.com/000065650/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0003-PSV-2023-0004?article=000065650 -
References () https://www.zerodayinitiative.com/advisories/ZDI-23-838/ - () https://www.zerodayinitiative.com/advisories/ZDI-23-838/ -

03 May 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 02:15

Updated : 2025-01-03 17:03

NVD link : CVE-2023-34284

Mitre link : CVE-2023-34284

CVE.ORG link : CVE-2023-34284

JSON object : View

Products Affected

netgear

  • rax30_firmware
  • rax30
CWE
CWE-798

Use of Hard-coded Credentials