Netgear wireless router open to code execution after buffer overflow vulnerability
Summary: Cisco Talos disclosed a stack-based buffer overflow in the Netgear RAX30 dual-band home Wi-Fi router, tracked as TALOS-2023-1887 (CVE-2023-48725), where a specially crafted HTTP request could let an attacker execute arbitrary code; Netgear stated exploitation requires the Wi-Fi password or an Ethernet connection to a device on the network. Talos also disclosed TALOS-2023-1849 (CVE-2024-0071), an out-of-bounds read in the shader functionality of the NVIDIA D3D10 driver version 546.01 that can leak memory and was tested from a Windows Hyper-V guest using RemoteFX to reach code execution on the host, and TALOS-2023-1870, a Chrome video encoder denial-of-service triggered by visiting an attacker-created website.
Key Takeaway: The NVIDIA flaw was demonstrated crossing from a Hyper-V guest to the host through RemoteFX, so a compromise inside a virtual machine can become a compromise of the machine hosting it - and Microsoft no longer actively maintains RemoteFX, leaving older machines that still use it exposed.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-48725CVE-2024-0071
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026