CVE-2023-34285 is a stack-based buffer overflow in a library used by the telnet service on NETGEAR RAX30 routers, scored 8.8 High. A network adjacent attacker needs no login and can run code as root. NETGEAR's fix is firmware 1.0.11.96 (Hot Fix), so update the router.
What's affected
The record lists the NETGEAR RAX30 router and its firmware. The flaw is in a shared library used by the telnetd service, which listens on TCP port 23 by default. The function named in the advisory is cmsCli_authenticate.
The ZDI advisory names no affected version list. It points to NETGEAR's knowledge base article for the fix, titled RAX30 Firmware Version 1.0.11.96 Hot Fix. That article says the hot fix addresses security vulnerabilities but does not list which ones, so it does not name this CVE. Treat the link between the two as ZDI's statement, not NETGEAR's.
The issue was reported to NETGEAR on 22 February 2023 and the advisory was released on 8 June 2023.
How to check if you're exposed
Sign in to the router's admin page and open the firmware or administration screen, where the current version is shown. If it is older than 1.0.11.96, plan the update. NETGEAR's app and admin page can also check for new firmware.
You can also test whether the telnet port is reachable from another device on your LAN. From a Linux or macOS machine, this command prints a line if port 23 accepts a connection:
nc -zv 192.168.1.1 23
Replace the address with your router's. If the port is open and you did not turn it on yourself, find out why before you do anything else.
What to do now
- Install RAX30 firmware 1.0.11.96 or later from NETGEAR's support page, and confirm the version on the admin screen afterward.
- Check whether the telnet service is reachable on the LAN and disable it if the device offers that setting and you do not need it.
- Segment the network so that guest and IoT devices cannot reach the router's management services.
- Turn on automatic firmware updates if the router supports them, and record the firmware version in your asset list.
- Review the NETGEAR security page for newer advisories on the RAX30.
Why it matters
A stack-based buffer overflow happens when code copies data of unchecked length into a fixed size buffer on the stack. Writing past the end can overwrite control data and let an attacker redirect execution. Here the copy happens before authentication finishes, which is why no login is needed.
The code runs as root on a router, so the result is full control of a device that carries all of the network's traffic. The network adjacent requirement limits who can try it, but in a shared office, apartment building or a network with one compromised laptop, that limit is thinner than it sounds.
The weakness classes involved are CWE-121 (Stack-based Buffer Overflow), CWE-787 (Out-of-bounds Write). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Both NVD and ZDI score this CVE 8.8, so there is no severity conflict. NETGEAR's article names a fixed firmware version but does not name this CVE.
Try it yourself
Not every high score deserves the same urgency. This demo shows how to weigh network reach, authentication and exploit status when deciding what to patch first.
Click through it at your own pace, or open it full screen.
Quick check
Is the telnet service always on?
The advisory says telnetd listens on TCP port 23 by default on the affected device. Check your own router, because a later firmware setting may change that.
Does the NETGEAR article name this CVE?
No. It says the hot fix addresses security vulnerabilities without listing them. The mapping to CVE-2023-34285 comes from the ZDI advisory.
Sources
Last reviewed: 19 October 2026.
