CVE-2023-48725 is a high severity (CVSS 7.2) stack-based buffer overflow in the JSON parsing of Netgear RAX30 routers. It needs a logged in session to trigger. Netgear says firmware 1.0.13.102_HOTFIX fixes the RAX28, RAX29 and RAX30, so update the router and protect the admin login.
What's affected
- The NVD record lists RAX30 firmware 1.0.11.96 and 1.0.7.78 as affected, in the getblockschedule JSON handling.
- Netgear's advisory PSV-2023-0160 names three routers: RAX28, RAX29 and RAX30, each fixed in firmware version 1.0.13.102_HOTFIX. It was first published on 6 March 2024.
- Source conflict: the record names only the RAX30, while the vendor advisory also lists the RAX28 and RAX29. Treat all three models as affected.
- Netgear says exploitation needs the attacker to have your Wi-Fi password or an Ethernet connection to a device on your network.
- Severity: the record gives CVSS 7.2, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with low attack complexity, requiring high privileges and no user interaction. Impact on confidentiality is high, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Log in to the router admin page and read the firmware version, or check it in the Netgear app. Compare it to 1.0.13.102_HOTFIX.
The vendor's guidance for fetching firmware is to open Netgear Support, enter the model number, choose Downloads, pick the first download titled Firmware Version, and follow its release notes. If the router offers automatic updates, check that they are on and that the last check succeeded.
If you run these routers at several sites, collect the firmware versions in one list.
What to do now
- Update the RAX28, RAX29 or RAX30 to firmware 1.0.13.102_HOTFIX or later, following the release notes.
- Change the router admin password to a unique one, since exploitation needs an authenticated request.
- Rotate the Wi-Fi password if it has been given to guests or contractors you no longer trust.
- Turn off remote administration unless you need it, and limit admin access to the LAN.
- Keep a record of router models and firmware in your inventory so future advisories are easy to match.
Why it matters
The class is CWE-121 (Stack-based Buffer Overflow), a type of CWE-787 (Out-of-bounds Write). A stack buffer overflow happens when a program copies input into a fixed size area of memory without checking its length, overwriting neighbouring data. In a JSON parser on a router, that can crash the service or, in the worst case, let the attacker run code, which is the outcome the record describes.
The requirement for authentication lowers the likelihood, and the vector reflects that with a high privilege requirement. It does not remove the risk. Shared passwords, default credentials and devices on a flat network turn an authenticated bug into a practical one. Home routers used by remote staff are also part of the corporate attack surface.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can someone on the internet exploit this?
Netgear says the attacker needs your Wi-Fi password or a wired connection to a device on your network, and the record needs authentication.
Where is the Talos report?
The record links Cisco Talos report TALOS-2023-1887. We could not open it from our environment, so this post relies on the record and the Netgear advisory.
Sources
- Netgear security advisory PSV-2023-0160
- Cisco Talos TALOS-2023-1887, listed in the record, not retrieved
Last reviewed: 19 October 2026.
