CVE-2023-28337

HIGH

Netgear Nighthawk Wifi6 Router (RAX30) - Unrestricted Firmware Upload via Hidden forceFWUpdate Parameter

Title source: llm
STIX 2.1

Description

When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force the upgrade to complete and bypass certain validation checks. End users can use this to upload modified, unofficial, and potentially malicious firmware to the device.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0072
EPSS Percentile 49.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
netgear/rax30_firmware
Published Mar 15, 2023
Tracked Since Feb 18, 2026