CVE-2023-35722 is a high severity (CVSS 8.8) command injection flaw in how the NETGEAR RAX30 router handles UPnP port mapping requests. An attacker on the adjacent network could run code as root without logging in. NETGEAR fixed it in firmware 1.0.11.96_2_HOTFIX.
What's affected
NETGEAR advisory PSV-2023-0046 lists the RAX30 as affected and 1.0.11.96_2_HOTFIX as the fixed firmware. It scores the flaw 8.8, High, with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The record matches on score and vector, so the sources agree.
The weakness is CWE-78, OS command injection. The record's KEV flag is false, and the NETGEAR page does not report exploitation.
How to check if you're exposed
- Sign in to the router's admin interface and read the firmware version.
- Compare it with 1.0.11.96_2_HOTFIX. Older builds on an RAX30 need the update.
- Check whether UPnP is enabled in the advanced settings. The flaw is in UPnP handling, so knowing whether the feature is on helps you judge exposure while you schedule the update.
- Record the model and version of any RAX30 at branch offices or remote workers' homes that your company supports.
What to do now
- Install firmware 1.0.11.96_2_HOTFIX or later through the Nighthawk app or from NETGEAR Support.
- NETGEAR notes the hotfix is a targeted security fix, so watch the device after installing it.
- Turn UPnP off if you do not need it.
- Keep guests and untrusted devices on a separate network from the one that carries the router's management traffic.
Why it matters
Command injection happens when a program builds a system command out of text the sender controls and does not check it first. The ZDI description says the router uses a string from a UPnP port mapping request in a system call, and that code runs as root.
Root on the gateway means control of the traffic that passes through it. Home routers are also rarely monitored, so a compromise can last. The adjacent network vector limits who can try it, but that includes anyone on the same Wi-Fi or LAN.
Router and access point firmware rarely shows up in software scans. Keep a list of model, firmware version and owner for every network device, review it whenever a vendor advisory lands, and set a date for each update. A list like that turns an advisory into a ten minute check instead of a search.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a login needed to use this flaw?
No. The record and advisory both describe it as pre-authentication.
What fixes it?
Firmware 1.0.11.96_2_HOTFIX, according to NETGEAR.
Sources
Last reviewed: 19 October 2026.
