CVE-2025-44658

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them ...

CVE-2025-44658

Netgear RAX30 appears affected (version V1.0.10.94). The issue is a PHP-FPM misconfiguration that fails to limit PHP-FPM to .php extensions, allowing uploaded scripts with alternate extensions to be executed as PHP. Consequences described include remote code execution, information disclosure, or ...

CVE-2025-44652

CVE-2025-44652 affects Netgear RAX30 with version V1.0.10.94_3. The issue is that the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files , which can cause a denial of service when unlimited users connect. The core details come from multiple sources (including Red Ha...

CVE-2025-44658

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them ...

CVE-2025-44652

In Netgear RAX30 V1.0.10.943, the USERLIMITGLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited users are connected...

NETGEAR RAX30 安全漏洞

The NETGEAR RAX30 is a dual-band wireless router from NETGEAR. A security vulnerability exists in NETGEAR RAX30 version V1.0.10.943, which can be exploited by an attacker to potentially cause a denial of service attack...

PT-2025-30295 · NetGear · Netgear Rax30

Name of the Vulnerable Software and Affected Versions: Netgear RAX30 version 1.0.10.94 Description: A PHP-FPM misconfiguration vulnerability exists due to not restricting PHP-FPM to only handle .php extensions. An attacker can exploit this by uploading malicious scripts with alternate extensions...

CVE-2023-48725

A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule functionality of Netgear RAX30 1.0.11.96 and 1.0.7.78. A specially crafted HTTP request can lead to code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2023-1327

Netgear RAX30 AX2400, prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by resetting the admin password...

CVE-2022-4390

A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions...

NETGEAR RAX30 Trust Management Issue Vulnerability

NETGEAR RAX30 is a WiFi 6 router from NETGEAR , supporting dual-band 2.4GHz and 5GHz with a maximum transmission rate of 2400Mbps, three external antenna design, and equipped with a 1.5GHz triple-core processor for simultaneous connection of up to 20 devices. The NETGEAR RAX30 suffers from a trus...

NETGEAR RAX30 Buffer Overflow Vulnerability

The NETGEAR RAX30 is a dual-band wireless router from NETGEAR. The NETGEAR RAX30 suffers from a buffer overflow vulnerability that stems from a lack of validation of the length of user-supplied data, which can be exploited by an attacker to execute arbitrary code...

CVE-2023-51634

NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this...

CVE-2023-51635

NETGEAR RAX30 fingdil Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2023-51634

NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this...

CVE-2023-51635

NETGEAR RAX30 fingdil Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2023-51634

NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this...

CVE-2023-51635

NETGEAR RAX30 fingdil Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2023-51635 NETGEAR RAX30 fing_dil Stack-based Buffer Overflow Remote Code Execution Vulnerability

NETGEAR RAX30 fingdil Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2023-51635

The CVE-2023-51635 issue affects NETGEAR RAX30 routers, specifically the fing_dil service. It is a stack-based buffer overflow caused by inadequate validation of the length of user-supplied data before copying to a fixed-length buffer. This allows network-adjacent attackers to execute arbitrary c...