CVE-2024-5247

2024-05-2322:15:14

CWE-434

[email protected]

web.nvd.nist.gov

cve-2024-5247

network management system

remote code execution

vulnerability

authentication

uploadservlet

data validation

arbitrary files

zdi-can-22923

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0005 Low

EPSS

Percentile

16.2%

JSON

NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.

The specific flaw exists within the UpLoadServlet class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22923.

Affected configurations

Vulners

Node

netgearprosafe_network_management_systemRange≤1.7.0.34

CNA Affected

[
  {
    "vendor": "NETGEAR",
    "product": "ProSAFE Network Management System",
    "versions": [
      {
        "version": "1.7.0.34 x64",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]