CVE-2023-38097

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38097
NETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the BkreProcessThread class. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19719.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025
https://www.zerodayinitiative.com/advisories/ZDI-23-919/
Configurations

No configuration.

History

09 May 2024, 23:15

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de ejecución remota de código de función peligrosa expuesta BkreProcessThread del sistema de gestión de red NETGEAR ProSAFE. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de NETGEAR ProSAFE Network Management System. Aunque se requiere autenticación para aprovechar esta vulnerabilidad, se puede omitir el mecanismo de autenticación existente. La falla específica existe dentro de la clase BkreProcessThread. El problema se debe a una función peligrosa expuesta. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de SYSTEM. Era ZDI-CAN-19719.
Summary (en) NETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the BkreProcessThread class. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19719. (en) NETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the BkreProcessThread class. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19719.

03 May 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 02:15

Updated : 2024-05-09 23:15

NVD link : CVE-2023-38097

Mitre link : CVE-2023-38097

CVE.ORG link : CVE-2023-38097

JSON object : View

Products Affected

No product.

CWE
CWE-749

Exposed Dangerous Method or Function