CVE-2023-23110

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-23110
An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured with a fixed checksum number. Therefore, an attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the checksum verification. This affects WNR612v2 Wireless Routers 1.0.0.3 and earlier, DGN1000v3 Modem Router 1.0.0.22 and earlier, D6100 WiFi DSL Modem Routers 1.0.0.63 and earlier, WNR1000v2 Wireless Routers 1.1.2.60 and earlier, XAVN2001v2 Wireless-N Extenders 0.4.0.7 and earlier, WNR2200 Wireless Routers 1.0.1.102 and earlier, WNR2500 Wireless Routers 1.0.0.34 and earlier, R8900 Smart WiFi Routers 1.0.3.6 and earlier, and R9000 Smart WiFi Routers 1.0.3.6 and earlier.

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BkBPIeGco Exploit Third Party Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/H1lIcXbco Exploit Third Party Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/HyZRxmb9s Exploit Third Party Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1BNhbWqi Exploit Third Party Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1qWglM5o Exploit Third Party Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1t47Ebqj Exploit Third Party Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SJCGkb-9o Exploit Third Party Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/r1Z4BX-5i Exploit Third Party Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/ryjVZz-5s Exploit Third Party Advisory
https://www.netgear.com/about/security/ Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:netgear:wnr612v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wnr612v2:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netgear:dgn1000v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:dgn1000v3:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netgear:d6100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:d6100:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netgear:wnr1000v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wnr1000v2:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netgear:xavn2001v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xavn2001v2:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netgear:wnr2200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wnr2200:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netgear:wnr2500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wnr2500:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netgear:r8900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r8900:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r9000:-:*:*:*:*:*:*:*
History

09 Feb 2023, 21:51

Type Values Removed Values Added
First Time Netgear d6100
Netgear wnr1000v2
Netgear xavn2001v2
Netgear r8900
Netgear dgn1000v3 Firmware
Netgear wnr2500 Firmware
Netgear
Netgear r9000 Firmware
Netgear wnr2200
Netgear wnr2200 Firmware
Netgear xavn2001v2 Firmware
Netgear r8900 Firmware
Netgear wnr1000v2 Firmware
Netgear wnr612v2
Netgear dgn1000v3
Netgear wnr612v2 Firmware
Netgear r9000
Netgear wnr2500
Netgear d6100 Firmware
CWE CWE-494
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/H1lIcXbco - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/H1lIcXbco - Exploit, Third Party Advisory
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/r1Z4BX-5i - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/r1Z4BX-5i - Exploit, Third Party Advisory
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SJCGkb-9o - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SJCGkb-9o - Exploit, Third Party Advisory
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1t47Ebqj - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1t47Ebqj - Exploit, Third Party Advisory
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/HyZRxmb9s - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/HyZRxmb9s - Exploit, Third Party Advisory
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1qWglM5o - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1qWglM5o - Exploit, Third Party Advisory
References (MISC) https://www.netgear.com/about/security/ - (MISC) https://www.netgear.com/about/security/ - Vendor Advisory
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/ryjVZz-5s - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/ryjVZz-5s - Exploit, Third Party Advisory
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1BNhbWqi - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1BNhbWqi - Exploit, Third Party Advisory
References (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BkBPIeGco - (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BkBPIeGco - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.4
CPE cpe:2.3:o:netgear:wnr1000v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:wnr2200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r8900:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:d6100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xavn2001v2:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wnr1000v2:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:wnr612v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:dgn1000v3:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r8900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:d6100:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wnr612v2:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:xavn2001v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:wnr2500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wnr2500:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wnr2200:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:dgn1000v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r9000:-:*:*:*:*:*:*:*

03 Feb 2023, 00:15

Type Values Removed Values Added
References
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1qWglM5o', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1qWglM5o', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1t47Ebqj', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1t47Ebqj', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1BNhbWqi', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1BNhbWqi', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/H1lIcXbco', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/H1lIcXbco', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/BkBPIeGco', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/BkBPIeGco', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/ryjVZz-5s', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/ryjVZz-5s', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/SJCGkb-9o', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/SJCGkb-9o', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/r1Z4BX-5i', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/r1Z4BX-5i', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/HyZRxmb9s', 'name': 'https://hackmd.io/@slASVrz_SrW7NQCsunofeA/HyZRxmb9s', 'tags': [], 'refsource': 'MISC'}
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BkBPIeGco -
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/H1lIcXbco -
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/r1Z4BX-5i -
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/SJCGkb-9o -
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/HyZRxmb9s -
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1t47Ebqj -
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1qWglM5o -
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/ryjVZz-5s -
  • (MISC) https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1BNhbWqi -

02 Feb 2023, 20:20

Type Values Removed Values Added
Summary An exploitable firmware modification vulnerability was discovered in WNR612v2 Wireless Routers firmware version 1.0.0.3 and earlier. The data integrity of the uploaded firmware image is ensured with a fixed checksum number. Therefore, an attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the checksum verification. An exploitable firmware modification vulnerability was discovered in certain Netgear products. The data integrity of the uploaded firmware image is ensured with a fixed checksum number. Therefore, an attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the checksum verification. This affects WNR612v2 Wireless Routers 1.0.0.3 and earlier, DGN1000v3 Modem Router 1.0.0.22 and earlier, D6100 WiFi DSL Modem Routers 1.0.0.63 and earlier, WNR1000v2 Wireless Routers 1.1.2.60 and earlier, XAVN2001v2 Wireless-N Extenders 0.4.0.7 and earlier, WNR2200 Wireless Routers 1.0.1.102 and earlier, WNR2500 Wireless Routers 1.0.0.34 and earlier, R8900 Smart WiFi Routers 1.0.3.6 and earlier, and R9000 Smart WiFi Routers 1.0.3.6 and earlier.
References
  • (MISC) https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1qWglM5o -
  • (MISC) https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1t47Ebqj -
  • (MISC) https://hackmd.io/@slASVrz_SrW7NQCsunofeA/S1BNhbWqi -
  • (MISC) https://hackmd.io/@slASVrz_SrW7NQCsunofeA/H1lIcXbco -
  • (MISC) https://hackmd.io/@slASVrz_SrW7NQCsunofeA/BkBPIeGco -
  • (MISC) https://hackmd.io/@slASVrz_SrW7NQCsunofeA/ryjVZz-5s -
  • (MISC) https://hackmd.io/@slASVrz_SrW7NQCsunofeA/r1Z4BX-5i -
  • (MISC) https://hackmd.io/@slASVrz_SrW7NQCsunofeA/HyZRxmb9s -

02 Feb 2023, 15:17

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-02 15:17

Updated : 2023-12-10 14:48

NVD link : CVE-2023-23110

Mitre link : CVE-2023-23110

CVE.ORG link : CVE-2023-23110

JSON object : View

Products Affected

netgear

  • dgn1000v3_firmware
  • wnr2200
  • wnr2200_firmware
  • xavn2001v2_firmware
  • wnr2500_firmware
  • dgn1000v3
  • wnr1000v2
  • r8900_firmware
  • r9000_firmware
  • r8900
  • wnr612v2_firmware
  • d6100_firmware
  • wnr2500
  • wnr1000v2_firmware
  • wnr612v2
  • r9000
  • xavn2001v2
  • d6100
CWE
CWE-494

Download of Code Without Integrity Check