CVE-2023-34283
NETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability
- State
- Published
- Severity
- 4.6 Medium
- Published
- May 3, 2024
- Updated
- Aug 2, 2024
- Reserved
- May 31, 2023
Description
NETGEAR RAX30 USB Share Link Following Information Disclosure Vulnerability. This vulnerability allows physically present attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of symbolic links on removable USB media. By creating a symbolic link, an attacker can abuse the router's web server to access arbitrary local files. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-19498.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 4.6 Medium | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | zdi |
Weaknesses
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected Products
| Product | Versions |
|---|---|
RAX30NETGEAR |
|
References
- ZDI-23-837
- vendor-provided URLvendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.