CVE-2023-28338

Published: Mar 15, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body being written to “/tmp/mulipartFile” on the device itself. A sufficiently large file will cause device resources to be exhausted, resulting in the device becoming unusable until it is rebooted.

Affected (1)

Products: Netgear: Rax30 Firmware

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Rax30 Firmware	All versions

Running on/with	Platform Versions
Netgear Rax30	All versions

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

https://drupal9.tenable.com/security/research/tra-2023-12

Source: vulnreport@tenable.com

Permissions Required

https://drupal9.tenable.com/security/research/tra-2023-12

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

Timeline

No history available yet.