CVE-2023-49694

NETGEAR ProSAFE Network Management System Privilege Escalation Via MySQL Server

A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the security context of SYSTEM.

Affected

NETGEAR · NETGEAR ProSAFE Network Management System

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.54% chance of exploitation in the next 30 days, 44th percentile

Published

2023-11-29

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://www.tenable.com/security/research/tra-2023-39

Security advisories

• https://kb.netgear.com/000065885/Security-Advisory-for-Vertical-Privilege-Escalation-on-t…

References

• CVE Record
• NVD entry