CVE-2023-50231

Critical

Description

NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the saveNodeLabel method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-21838.

SeverityCritical

CVSS9.6

Exploit probability—

Product

Netgear Prosafe Network Management System

PublishedMay 3, 2024

First seenMay 3, 2024

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

netgear prosafe_network_management_system1.7.0.31 or later

Vendor advisories

kb.netgear.com/000065901/Security-Advisory-for-Stored-Cross-Site-Scripting-on-the-NMS300-PSV-2023-0106

Affected products

Product	Affected versions	Fixed in
netgear prosafe_network_management_system	v < 1.7.0.31	1.7.0.31

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.