CVE-2023-38098
📋 TL;DR
This vulnerability allows authenticated remote attackers to bypass authentication and upload arbitrary files to NETGEAR ProSAFE Network Management System, leading to remote code execution with SYSTEM privileges. It affects NETGEAR ProSAFE NMS installations where the vulnerable UpLoadServlet component is exposed. Attackers can gain complete control of affected systems.
💻 Affected Systems
- NETGEAR ProSAFE Network Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling data theft, lateral movement, and persistent backdoor installation.
Likely Case
Unauthorized file upload leading to web shell deployment and subsequent command execution on the NMS server.
If Mitigated
Limited to authenticated users only, but authentication bypass makes this ineffective without additional controls.
🎯 Exploit Status
Authentication bypass exists, making exploitation straightforward once the bypass method is known. ZDI has published technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.7.0.22 or later
Vendor Advisory: https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025
Restart Required: Yes
Instructions:
1. Download the latest version from NETGEAR support portal. 2. Backup current configuration. 3. Run the installer to upgrade to version 1.7.0.22 or later. 4. Restart the NMS service.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the NMS web interface to trusted IP addresses only.
Use firewall rules to allow only specific source IPs to TCP ports 80/443
Authentication Hardening
allImplement additional authentication layers or MFA to prevent bypass attempts.
Configure web server authentication or implement reverse proxy with additional auth
🧯 If You Can't Patch
- Isolate the NMS system on a separate network segment with strict access controls
- Implement web application firewall (WAF) rules to block file upload requests to UpLoadServlet endpoints
🔍 How to Verify
Check if Vulnerable:
Check NMS version in web interface or via installed program details. Versions below 1.7.0.22 are vulnerable.Check Version:
Check via NMS web interface at http(s)://[nms-ip]/ or examine installed programs in Windows Control PanelVerify Fix Applied:
Confirm version is 1.7.0.22 or higher in the NMS web interface under System Information.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload requests to /servlet/UpLoadServlet
- Authentication bypass attempts
- Unexpected process execution from web directories
Network Indicators:
- POST requests to UpLoadServlet endpoints with file uploads
- Unusual outbound connections from NMS server
SIEM Query:
source="nms_logs" AND (uri="/servlet/UpLoadServlet" OR process="cmd.exe" OR process="powershell.exe")🔗 References
- https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025
- https://www.zerodayinitiative.com/advisories/ZDI-23-918/
- https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025
- https://www.zerodayinitiative.com/advisories/ZDI-23-918/
