Sign-up

ID

VAR-202306-2270


CVE

CVE-2023-35721


TITLE

of netgear  RAX50  Certificate validation vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2023-029514

DESCRIPTION

NETGEAR Multiple Routers curl_post Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the update functionality, which operates over HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19981. (DoS) It may be in a state. NETGEAR Routers are a series of routers from NETGEAR

Trust: 2.79

sources: NVD: CVE-2023-35721 // JVNDB: JVNDB-2023-029514 // ZDI: ZDI-23-893 // CNVD: CNVD-2025-11214

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-11214

AFFECTED PRODUCTS

vendor:netgearmodel:rax50scope:ltversion:1.0.15.128

Trust: 1.0

vendor:ネットギアmodel:rax50scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax50scope:eqversion:rax50 firmware 1.0.15.128

Trust: 0.8

vendor:ネットギアmodel:rax50scope:eqversion: -

Trust: 0.8

vendor:netgearmodel:multiple routersscope: - version: -

Trust: 0.7

vendor:netgearmodel:routersscope: - version: -

Trust: 0.6

sources: ZDI: ZDI-23-893 // CNVD: CNVD-2025-11214 // JVNDB: JVNDB-2023-029514 // NVD: CVE-2023-35721

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2023-35721
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2023-35721
value: HIGH

Trust: 1.0

NVD: CVE-2023-35721
value: HIGH

Trust: 0.8

ZDI: CVE-2023-35721
value: HIGH

Trust: 0.7

CNVD: CNVD-2025-11214
value: HIGH

Trust: 0.6

CNVD: CNVD-2025-11214
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2023-35721
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2023-35721
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-35721
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2023-35721
baseSeverity: HIGH
baseScore: 8.1
vectorString: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-23-893 // CNVD: CNVD-2025-11214 // JVNDB: JVNDB-2023-029514 // NVD: CVE-2023-35721 // NVD: CVE-2023-35721

PROBLEMTYPE DATA

problemtype:CWE-295

Trust: 1.0

problemtype:Illegal certificate verification (CWE-295) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-029514 // NVD: CVE-2023-35721

PATCH

title:NETGEAR has issued an update to correct this vulnerability.url:https://kb.netgear.com/000065668/Security-Advisory-for-Improper-Remote-Server-Certificate-Validation-on-the-RAX50-PSV-2023-0019

Trust: 0.7

title:Patch for NETGEAR Routers Code Execution Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/692186

Trust: 0.6

sources: ZDI: ZDI-23-893 // CNVD: CNVD-2025-11214

EXTERNAL IDS

db:NVDid:CVE-2023-35721

Trust: 3.9

db:ZDIid:ZDI-23-893

Trust: 2.5

db:JVNDBid:JVNDB-2023-029514

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-19981

Trust: 0.7

db:CNVDid:CNVD-2025-11214

Trust: 0.6

sources: ZDI: ZDI-23-893 // CNVD: CNVD-2025-11214 // JVNDB: JVNDB-2023-029514 // NVD: CVE-2023-35721

REFERENCES

url:https://kb.netgear.com/000065668/security-advisory-for-improper-remote-server-certificate-validation-on-the-rax50-psv-2023-0019

Trust: 2.5

url:https://www.zerodayinitiative.com/advisories/zdi-23-893/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2023-35721

Trust: 0.8

url:http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2023-35721

Trust: 0.6

sources: ZDI: ZDI-23-893 // CNVD: CNVD-2025-11214 // JVNDB: JVNDB-2023-029514 // NVD: CVE-2023-35721

CREDITS

Zach Hanley (@hacks_zach) of Horizon3 A.I.

Trust: 0.7

sources: ZDI: ZDI-23-893

SOURCES

db:ZDIid:ZDI-23-893
db:CNVDid:CNVD-2025-11214
db:JVNDBid:JVNDB-2023-029514
db:NVDid:CVE-2023-35721

LAST UPDATE DATE

2025-08-10T23:12:14.805000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-23-893date:2023-06-30T00:00:00
db:CNVDid:CNVD-2025-11214date:2025-05-30T00:00:00
db:JVNDBid:JVNDB-2023-029514date:2025-08-08T08:17:00
db:NVDid:CVE-2023-35721date:2025-08-07T14:44:37.740

SOURCES RELEASE DATE

db:ZDIid:ZDI-23-893date:2023-06-30T00:00:00
db:CNVDid:CNVD-2025-11214date:2025-05-27T00:00:00
db:JVNDBid:JVNDB-2023-029514date:2025-08-08T00:00:00
db:NVDid:CVE-2023-35721date:2024-05-03T02:15:34.800