プラットフォーム
netgear
コンポーネント
netgear-prosafe-network-management-system
修正版
1.7.1
CVE-2023-38096 is a critical authentication bypass vulnerability affecting NETGEAR ProSAFE Network Management System version 1.7.0.12. This flaw allows remote attackers to bypass authentication controls, potentially leading to unauthorized access and control of the system. Successful exploitation requires no credentials, significantly increasing the risk. A fix is available from NETGEAR.
The impact of CVE-2023-38096 is severe. An attacker can exploit this vulnerability to gain complete, unauthorized access to the NETGEAR ProSAFE Network Management System without needing valid credentials. This could allow them to modify network configurations, steal sensitive data stored on the system, or launch further attacks against other devices on the network. The lack of authentication requirement makes this vulnerability particularly dangerous, as it bypasses a fundamental security control. This is similar to other authentication bypass vulnerabilities where attackers can directly access backend systems.
CVE-2023-38096 was disclosed on May 3, 2024. The vulnerability was reported to NETGEAR as ZDI-CAN-19718. The CVSS score of 9.8 (CRITICAL) indicates a high probability of exploitation. Public proof-of-concept (POC) code is currently unavailable, but the ease of exploitation (no credentials required) suggests that it is likely to emerge. It is not currently listed on the CISA KEV catalog.
Organizations using NETGEAR ProSAFE Network Management System version 1.7.0.12 are at significant risk. This includes small to medium-sized businesses (SMBs) and enterprises that rely on NETGEAR ProSAFE devices for network management. Shared hosting environments utilizing this version are particularly vulnerable, as a compromise of one user could potentially affect others.
• windows / supply-chain:
Get-Process -Name "ProSAFE Network Management System*" | Select-Object ProcessName, Id, CPU, WorkingSet• windows / supply-chain:
Get-WinEvent -LogName Security -Filter "EventID = 4625" -MaxEvents 10 | Select-Object TimeCreated, Message• generic web:
curl -I http://<target_ip>/index.php• generic web:
grep -i "authentication bypass" /var/log/apache2/access.logdisclosure
エクスプロイト状況
EPSS
74.93% (99% パーセンタイル)
CISA SSVC
CVSS ベクトル
The primary mitigation for CVE-2023-38096 is to upgrade to a patched version of the NETGEAR ProSAFE Network Management System as soon as it becomes available from NETGEAR. Until the upgrade is possible, consider implementing temporary workarounds such as restricting network access to the management interface using firewalls or access control lists (ACLs). Monitor network traffic for suspicious activity targeting the management interface. While a WAF might offer some protection, it is not a substitute for patching the underlying vulnerability. After upgrading, confirm the fix by attempting to access the management interface without providing valid credentials; access should be denied.
認証バイパスの脆弱性を修正する NETGEAR ProSAFE Network Management System のバージョンにアップデートしてください。修正されたバージョンとアップデート手順については、NETGEAR セキュリティアドバイザリ (PSV-2023-0024-PSV-2023-0025) を参照してください。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2023-38096 is a critical vulnerability in NETGEAR ProSAFE Network Management System allowing attackers to bypass authentication without credentials, potentially gaining unauthorized access.
If you are using NETGEAR ProSAFE Network Management System version 1.7.0.12, you are affected by this vulnerability and should prioritize patching.
Upgrade to a patched version of NETGEAR ProSAFE Network Management System as soon as it becomes available from NETGEAR. Until then, implement temporary workarounds like restricting network access.
While no active exploitation has been publicly confirmed, the ease of exploitation suggests a high likelihood of exploitation in the near future.
Please refer to the official NETGEAR security advisory for CVE-2023-38096 on the NETGEAR support website.