CVE-2023-41183CWE-306

NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability

High · published May 3, 2024

CVSS v3.0
8.8
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR Orbi 760 routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the SOAP API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20524.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.13644 · 96.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-05-03T02:11Z
EPSS history
Timeline
  • 03 MAY 02:11Z
    NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability
    cvelistv5