平台
netgear
组件
netgear-prosafe-network-management-system
修复版本
1.7.1
CVE-2023-38096 is a critical authentication bypass vulnerability affecting NETGEAR ProSAFE Network Management System version 1.7.0.12. This flaw allows remote attackers to bypass authentication controls, potentially leading to unauthorized access and control of the system. Successful exploitation requires no credentials, significantly increasing the risk. A fix is available from NETGEAR.
The impact of CVE-2023-38096 is severe. An attacker can exploit this vulnerability to gain complete, unauthorized access to the NETGEAR ProSAFE Network Management System without needing valid credentials. This could allow them to modify network configurations, steal sensitive data stored on the system, or launch further attacks against other devices on the network. The lack of authentication requirement makes this vulnerability particularly dangerous, as it bypasses a fundamental security control. This is similar to other authentication bypass vulnerabilities where attackers can directly access backend systems.
CVE-2023-38096 was disclosed on May 3, 2024. The vulnerability was reported to NETGEAR as ZDI-CAN-19718. The CVSS score of 9.8 (CRITICAL) indicates a high probability of exploitation. Public proof-of-concept (POC) code is currently unavailable, but the ease of exploitation (no credentials required) suggests that it is likely to emerge. It is not currently listed on the CISA KEV catalog.
Organizations using NETGEAR ProSAFE Network Management System version 1.7.0.12 are at significant risk. This includes small to medium-sized businesses (SMBs) and enterprises that rely on NETGEAR ProSAFE devices for network management. Shared hosting environments utilizing this version are particularly vulnerable, as a compromise of one user could potentially affect others.
• windows / supply-chain:
Get-Process -Name "ProSAFE Network Management System*" | Select-Object ProcessName, Id, CPU, WorkingSet• windows / supply-chain:
Get-WinEvent -LogName Security -Filter "EventID = 4625" -MaxEvents 10 | Select-Object TimeCreated, Message• generic web:
curl -I http://<target_ip>/index.php• generic web:
grep -i "authentication bypass" /var/log/apache2/access.logdisclosure
漏洞利用状态
EPSS
74.93% (99% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2023-38096 is to upgrade to a patched version of the NETGEAR ProSAFE Network Management System as soon as it becomes available from NETGEAR. Until the upgrade is possible, consider implementing temporary workarounds such as restricting network access to the management interface using firewalls or access control lists (ACLs). Monitor network traffic for suspicious activity targeting the management interface. While a WAF might offer some protection, it is not a substitute for patching the underlying vulnerability. After upgrading, confirm the fix by attempting to access the management interface without providing valid credentials; access should be denied.
升级到修复身份验证绕过漏洞的 NETGEAR ProSAFE 网络管理系统版本。请参阅 NETGEAR 安全公告 (PSV-2023-0024-PSV-2023-0025) 以获取修复版本和升级说明。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2023-38096 is a critical vulnerability in NETGEAR ProSAFE Network Management System allowing attackers to bypass authentication without credentials, potentially gaining unauthorized access.
If you are using NETGEAR ProSAFE Network Management System version 1.7.0.12, you are affected by this vulnerability and should prioritize patching.
Upgrade to a patched version of NETGEAR ProSAFE Network Management System as soon as it becomes available from NETGEAR. Until then, implement temporary workarounds like restricting network access.
While no active exploitation has been publicly confirmed, the ease of exploitation suggests a high likelihood of exploitation in the near future.
Please refer to the official NETGEAR security advisory for CVE-2023-38096 on the NETGEAR support website.