CVE-2023-35721 is a high severity improper certificate validation flaw in the update function of NETGEAR RAX50 routers, rated 8.8 in the record and 8.1 by NETGEAR. A network-adjacent attacker could tamper with downloaded data. NETGEAR lists firmware 1.0.15.128 as the fix.
What's affected
The record and ZDI describe the flaw generically as affecting multiple NETGEAR routers, while NETGEAR's advisory PSV-2023-0019 lists only the RAX50 (WiFi 6). The fixed firmware is 1.0.15.128.
Severity differs by source. The record scores 8.8 with an adjacent network vector and low complexity (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NETGEAR scores 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Both are High. ZDI also gives 8.1. The record's KEV flag is false.
How to check if you're exposed
- Log in to the router's admin page and read the firmware version on the status or firmware update page.
- Compare it with 1.0.15.128. Anything older on a RAX50 needs the update.
- If you manage routers for several sites, collect the version from each one and note any model other than RAX50 so you can check NETGEAR's support pages for it.
- If you are not sure of the model, the label on the underside of the device shows it.
What to do now
- Update through the NETGEAR Nighthawk app, or download the firmware for your model from NETGEAR Support and follow its release notes.
- Confirm the version afterwards, since the advisory says the vulnerability remains until the update is installed.
- Until then, avoid triggering manual firmware checks on untrusted networks.
- Replace routers that no longer receive firmware.
Why it matters
The weakness is CWE-295, improper certificate validation. When a device fetches an update over HTTPS but does not properly check the server's certificate, anyone who can sit between the router and the update server can pose as that server.
ZDI says this flaw alone threatens the integrity of downloaded data, and that chained with other bugs it can lead to code execution as root. That is a reason to treat it seriously even though the standalone vector requires a favourable network position.
Router and access point firmware rarely shows up in software scans. Keep a list of model, firmware version and owner for every network device, review it whenever a vendor advisory lands, and set a date for each update. A list like that turns an advisory into a ten minute check instead of a search.
Quick check
Why does NETGEAR say 8.1 and the record 8.8?
They rate attack complexity and network position differently. Both place it in the High band.
Does it affect other NETGEAR models?
ZDI says multiple routers, but NETGEAR's advisory lists only the RAX50. Check your model on NETGEAR Support.
Sources
Last reviewed: 19 October 2026.
