CVE-2023-41182
📋 TL;DR
This vulnerability in NETGEAR ProSAFE Network Management System allows authenticated attackers to bypass authentication and execute arbitrary code with SYSTEM privileges via directory traversal in the ZipUtils class. It affects NETGEAR ProSAFE NMS installations where attackers can upload malicious zip files containing path traversal sequences. Organizations using this network management system are at risk.
💻 Affected Systems
- NETGEAR ProSAFE Network Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, allowing attackers to install malware, steal credentials, pivot to other systems, and maintain persistent access.
Likely Case
Unauthorized access to sensitive network management data, configuration tampering, and potential lateral movement within the network.
If Mitigated
Limited to authenticated users only, but authentication bypass makes this less effective; proper network segmentation could contain damage.
🎯 Exploit Status
Authentication required but can be bypassed. Exploit involves crafting malicious zip files with directory traversal sequences. ZDI has published technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0.22
Vendor Advisory: https://kb.netgear.com/000065705/Security-Advisory-for-Post-authentication-Command-Injection-on-the-Prosafe-Network-Management-System-PSV-2023-0037
Restart Required: Yes
Instructions:
1. Download version 1.7.0.22 from NETGEAR support portal. 2. Backup current configuration. 3. Stop NMS service. 4. Install update. 5. Restart service. 6. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate NMS system from internet and restrict access to authorized management networks only
Access Control
allImplement strict authentication controls and monitor for authentication bypass attempts
🧯 If You Can't Patch
- Remove internet-facing access immediately and restrict to management VLAN only
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check NMS version in web interface or via 'About' section. Versions below 1.7.0.22 are vulnerable.Check Version:
Check web interface at https://[nms-ip]:port or review installed programs in Windows Control PanelVerify Fix Applied:
Verify version is 1.7.0.22 or higher in NMS interface and test zip file upload functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual zip file uploads
- Authentication bypass attempts
- Process creation with SYSTEM privileges from NMS service
Network Indicators:
- Unusual outbound connections from NMS server
- Traffic to unexpected ports from NMS
SIEM Query:
source="nms_logs" AND (event="zip_upload" OR event="auth_bypass" OR process="cmd.exe" OR process="powershell.exe")🔗 References
- https://kb.netgear.com/000065705/Security-Advisory-for-Post-authentication-Command-Injection-on-the-Prosafe-Network-Management-System-PSV-2023-0037
- https://www.zerodayinitiative.com/advisories/ZDI-23-1284/
- https://kb.netgear.com/000065705/Security-Advisory-for-Post-authentication-Command-Injection-on-the-Prosafe-Network-Management-System-PSV-2023-0037
- https://www.zerodayinitiative.com/advisories/ZDI-23-1284/
