CVE-2023-2394

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Web Management Interface. The manipulation of the argument wanName leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227672. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Netgear	SRX5308	4.3.5-3

References

https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/14Exploit, Third Party Advisory
https://vuldb.com/?ctiid.227672Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.227672Permissions Required, Third Party Advisory, VDB Entry
https://github.com/leetsun/IoT/tree/main/Netgear-SRX5308/14Exploit, Third Party Advisory
https://vuldb.com/?ctiid.227672Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.227672Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: Apr 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-239405.3OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup CVE-2023-239417.5SwagPayPal is a PayPal integration for shopware/platform. If JavaScript-based PayPal checkout methods are used (PayPal Plus, Smart Payment B CVE-2023-239426.1The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing CVE-2023-239434.3Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to CVE-2023-239446.5Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext CVE-2023-239467.5Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.CVE-2023-239478.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, CVE-2023-239485.5The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is v CVE-2023-239495.4An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.CVE-2023-23956.1A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. This affects an unknown part of the component Web CVE-2023-239506.1User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.CVE-2023-239516.1Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application