CVE-2023-38101

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38101
NETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SettingConfigController class. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19725.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025
https://www.zerodayinitiative.com/advisories/ZDI-23-915/
Configurations

No configuration.

History

18 Sep 2024, 19:15

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de ejecución remota de código de función peligrosa expuesta en NETGEAR ProSAFE Network Management System SetConfigController. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de NETGEAR ProSAFE Network Management System. Aunque se requiere autenticación para aprovechar esta vulnerabilidad, se puede omitir el mecanismo de autenticación existente. La falla específica existe dentro de la clase ConfiguraciónConfigController. El problema se debe a una función peligrosa expuesta. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de SYSTEM. Era ZDI-CAN-19725.
Summary (en) NETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SettingConfigController class. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19725. (en) NETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the SettingConfigController class. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19725.

03 May 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-03 02:15

Updated : 2024-09-18 19:15

NVD link : CVE-2023-38101

Mitre link : CVE-2023-38101

CVE.ORG link : CVE-2023-38101

JSON object : View

Products Affected

No product.

CWE
CWE-749

Exposed Dangerous Method or Function