CVE-2023-27853

published 2023-03-10

CVE-2023-27853: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary…

Priority P2 68 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary code on the device.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
netgear	rax30_firmware	< 1.0.10.94	1.0.10.94

Detection & IOCs extracted from sources · hover to see the quote

• → Monitor SOAP requests where the SOAPAction header contains a payload exceeding 853 bytes after the '#' character — this triggers a buffer overflow in soap_serverd leading to a format string attack. ↗
• → Payloads of 1819+ bytes in the SOAPAction header (after '#') begin overwriting sprintf() arguments (local_58 and local_54), enabling a format string attack that can bypass stack canaries. ↗
• → Alert on unusually large SOAPAction headers in HTTP/SOAP traffic directed to LAN-side ports 5000 and 5043 on NETGEAR RAX30 devices. ↗
• → Look for stack smashing detection crashes (process termination/restart) in soap_serverd as an indicator of active exploitation attempts. ↗

• · Exploitation is constrained by ASLR on the device; a reliable exploit requires chaining with an information-leak vulnerability to obtain base addresses. ↗
• · The vulnerable soap_serverd service is only exposed on the LAN side of the device, limiting the attack vector to adjacent network (AV:A). ↗
• · Stack canaries are present in the soap_serverd binary but can be circumvented via the format string primitive if the attacker knows base addresses. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-120