CVE-2023-27360
Netgear Rax30 Firmware ≤ 1.0.10.94
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-27360 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Netgear Rax30 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31136
Vulnerability Data
NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the…
more
lighttpd HTTP server. The issue results from allowing execution of files from untrusted sources. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19398.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Explicit requirement to protect session authenticity structurally prevents the weakness for communications.
Information flow enforcement directly requires validating the source of data before allowing transmission or receipt.
Device identification and authentication mandates verifying the source before establishing connections.
Integrity verification tools detect (but do not stop) the acceptance of data lacking authenticity.
Cryptographic mechanisms can be used to verify authenticity, thereby preventing acceptance of invalid data.
Associating security attributes with exchanged information supports verification of authenticity.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls enforce origin validation at network boundaries.
Security of network services includes validating the authenticity of service endpoints.
A.8.24's guidance on identifying protection levels, selecting algorithms/strength for authenticity/integrity (items b,f), using cryptography for transmitted/stored data (c), and key management directly stops many CWE-345 exploits by ensuring verifiable authenticity; however, it leaves a bounded remainder where verification logic itself is flawed or absent (e.g. accepting unverified signatures or weak schemes), as the control depends on correct implementation in other mechanisms.
Secure SDLC incorporates authenticity verification requirements throughout development.
Application security requirements can mandate data authenticity verification mechanisms.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, zero-trust verification) plus design reviews that can catch and block origin-validation gaps in many common cases, but leaves a bounded remainder (e.g. protocol-level or third-party component origin errors not surfaced by the organization's review process).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.