Paper/Archive/CVE-2023-49693

CVE-2023-49693

NETGEAR NETGEAR ProSAFE Network Management System — NETGEAR ProSAFE Network Management System RCE via Unprotected Access to Java Debug Wire Protocol

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 67.0.670 × 2013.4 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code.

Affected

ProductAffectedFixed inSource

NETGEAR ProSAFE Network Management System< 1.7.0.341.7.0.34CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

tenable (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftenable.com/security/research/tra-2023-39 refkb.netgear.com/000065886/Security-Advisory-for-Sensitive-Information-Disclosure-on-the-NMS300-PSV-2023-0126