CVE-2023-40480 is a high severity (CVSS 8.8) command injection in the DHCP server of NETGEAR RAX30 routers. A network adjacent attacker needs no login and gets code execution as root. NETGEAR fixed it in firmware 1.0.9.92.
What's affected
The record names NETGEAR RAX30 firmware and the router itself, and scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The AV:A part means the attacker must be on the same network segment.
The weakness is CWE-78 (OS command injection). NETGEAR's advisory, first published on 2023-05-23, covers this CVE together with CVE-2023-40479 under PSV-2022-0360 and PSV-2022-0361, and says RAX30 is fixed in firmware version 1.0.9.92.
NETGEAR also says the vulnerabilities require an attacker to have your WiFi password or an Ethernet connection to your network. That narrows the exposure, and it is the reason the vector says adjacent and not network. The record is not marked as a CISA Known Exploited Vulnerability.
How to check if you're exposed
Log in to the router's administration page and read the firmware version, usually shown on the status or advanced home page. Anything earlier than 1.0.9.92 is affected for the RAX30 according to NETGEAR.
NETGEAR's own steps for updating are on its support site: search for the RAX30, open Downloads, choose the first download beginning with Firmware Version, read the release notes, and follow them. If your router updates automatically, still confirm the number. For a fleet of routers at small sites, record the version in your asset list.
What to do now
- Check the firmware version on every RAX30 you manage, including ones at home offices and branch sites.
- Update to 1.0.9.92 or later by following NETGEAR's release notes.
- Change the WiFi password if guests or former staff have had it, since the attack starts from inside the network.
- Keep guest devices on a separate guest network where the router supports it.
- Add the model and firmware to your asset list so the next advisory is a lookup.
Why it matters
The advisory text says the flaw lies in the DHCP server, where a user supplied string is used in a system call without proper validation. Command injection in a service that runs as root means the attacker's commands run with full control of the device.
Home and small office routers matter more than they look. They sit between everything on the network and the internet, and they are rarely checked after the day they were set up. The condition that the attacker be on the local network lowers the risk for a router in a locked office and raises it for a shared one, such as a building with open WiFi.
Quick check
Can someone attack this router from the internet?
The record's vector is adjacent, and NETGEAR says the attacker needs your WiFi password or an Ethernet connection. Neither describes a direct internet attack.
Does one firmware update cover both RAX30 CVEs?
NETGEAR's single advisory lists both CVEs and names firmware 1.0.9.92 as the fix for the RAX30.
Sources
Last reviewed: 19 October 2026.
