CVE-2024-5245
📋 TL;DR
This vulnerability allows local attackers with low-privileged access to escalate to SYSTEM privileges on NETGEAR ProSAFE Network Management System installations. Attackers can exploit default MySQL credentials in the installer to execute arbitrary code. Only users running affected NETGEAR NMS versions are impacted.
💻 Affected Systems
- NETGEAR ProSAFE Network Management System (NMS300)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of persistent malware, data theft, and lateral movement within the network.
Likely Case
Local privilege escalation leading to administrative control over the NMS system, potentially compromising managed network devices.
If Mitigated
Limited to low-privileged user compromise without ability to escalate if proper access controls and credential management are implemented.
🎯 Exploit Status
Requires existing low-privileged access to the system. Exploitation involves using known default credentials to access MySQL database with elevated privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0.20
Vendor Advisory: https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-0004
Restart Required: Yes
Instructions:
1. Download NMS300 version 1.7.0.20 from NETGEAR support site. 2. Backup current configuration. 3. Run installer as administrator. 4. Follow upgrade prompts. 5. Restart system after installation completes.
🔧 Temporary Workarounds
Change MySQL Default Credentials
windowsManually change the default MySQL root password used by the NMS installer
mysql -u root -p[default_password]
ALTER USER 'root'@'localhost' IDENTIFIED BY 'new_strong_password';
FLUSH PRIVILEGES;
Restrict Local User Access
windowsImplement strict access controls to prevent unauthorized local users from accessing the NMS system
🧯 If You Can't Patch
- Isolate the NMS system on a dedicated management VLAN with strict access controls
- Implement application whitelisting to prevent execution of unauthorized code on the NMS host
🔍 How to Verify
Check if Vulnerable:
Check NMS version in Help > About. If version is earlier than 1.7.0.20, system is vulnerable. Also check if MySQL is using default credentials.Check Version:
Check Help > About in NMS GUI or examine installed programs in Windows Control PanelVerify Fix Applied:
Confirm version shows 1.7.0.20 or later in Help > About. Test that default MySQL credentials no longer provide access.📡 Detection & Monitoring
Log Indicators:
- Failed MySQL authentication attempts followed by successful login with default credentials
- Unusual process execution with SYSTEM privileges from non-admin accounts
- Installation of new services or scheduled tasks
Network Indicators:
- Unexpected outbound connections from NMS system
- Database connection attempts from unauthorized IPs
SIEM Query:
EventID=4625 (failed logon) AND AccountName='root' OR EventID=4688 (process creation) AND NewProcessName contains 'cmd.exe' AND SubjectUserName not in admin_users🔗 References
- https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-0004
- https://www.zerodayinitiative.com/advisories/ZDI-24-496/
- https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-0004
- https://www.zerodayinitiative.com/advisories/ZDI-24-496/
