High severity · published May 3, 2024
CVE-2023-41183
NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability
8.8
CVSS
13.6%
EPSS
No
On KEV
Description
NETGEAR Orbi 760 SOAP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR Orbi 760 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the SOAP API. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20524.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.6% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rbr760 Firmware · Netgear
before 6.3.8.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41183
Vendor Advisory
https://kb.netgear.com/000065734/Security-Advisory-for-Authentication-Bypass-on-the-RBR760-PSV-2023-0052
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1283/
More from Rbr760 Firmware
8.0
CVE-2026-0411
A Sensitive Information Disclosure Vulnerability in NETGEAR Orbi Satellites
6.8
CVE-2026-11814
Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers
4.4
CVE-2026-11738
Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.