Rax29
Monthly
Authentication bypass in NETGEAR RAX30, RAX29, and RAX28 routers lets an unauthenticated attacker who is already on the same local network reach the device management service and either read device information or change administrative settings, compromising the confidentiality and integrity of management data and the availability of device-management functions. The flaw is an instance of CWE-288 (Authentication Bypass Using an Alternate Path or Channel), scored 6.3 by the vendor on the CVSS 4.0 scale, and it is gated by an adjacency requirement: an attacker must be on the local/Layer-2 network (wired LAN, Wi-Fi, potentially guest Wi-Fi) rather than the WAN side, so under a default configuration it is not exploitable from the internet. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has published a fix, available through NETGEAR support pages.
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent adversary who can intercept and modify local traffic to compromise both the confidentiality and integrity of affected devices. The root cause is CWE-295 (Improper Certificate Validation), meaning the device fails to properly authenticate the remote party during a network exchange - likely firmware update or cloud management traffic - enabling a suitably positioned attacker to inject commands without authenticating to the device. Exploitation is constrained by the requirement for physical network adjacency, active MitM capability, and affected region-specific SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in NETGEAR RAX30, RAX29, and RAX28 routers lets an unauthenticated attacker who is already on the same local network reach the device management service and either read device information or change administrative settings, compromising the confidentiality and integrity of management data and the availability of device-management functions. The flaw is an instance of CWE-288 (Authentication Bypass Using an Alternate Path or Channel), scored 6.3 by the vendor on the CVSS 4.0 scale, and it is gated by an adjacency requirement: an attacker must be on the local/Layer-2 network (wired LAN, Wi-Fi, potentially guest Wi-Fi) rather than the WAN side, so under a default configuration it is not exploitable from the internet. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has published a fix, available through NETGEAR support pages.
Command injection via attacker-in-the-middle on multiple NETGEAR router and mesh system models allows a network-adjacent adversary who can intercept and modify local traffic to compromise both the confidentiality and integrity of affected devices. The root cause is CWE-295 (Improper Certificate Validation), meaning the device fails to properly authenticate the remote party during a network exchange - likely firmware update or cloud management traffic - enabling a suitably positioned attacker to inject commands without authenticating to the device. Exploitation is constrained by the requirement for physical network adjacency, active MitM capability, and affected region-specific SKUs; no public exploit code or CISA KEV listing has been identified at time of analysis.