CVE-2024-57233

The command injection vulnerability (CWE-77) occurs in the vif_disable function, which does not properly validate the value passed through the iface parameter. An attacker can craft a request containing a malicious payload embedded in this parameter. Improperly constructed data is then passed directly to the system command interpreter, resulting in execution of arbitrary code in the context of the device.

An unauthenticated attacker from the network can gain full control over the device — read confidential configuration data, modify router settings, or use it as an access point for further attacks on the local network.

Apply patches available from the manufacturer according to the references. It is recommended to monitor official NETGEAR firmware updates for the RAX5 model and restrict access to the device management panel exclusively to trusted hosts.

NETGEAR RAX5 (AX1600 WiFi Router) with firmware version v1.0.2.26