Vulnerability · Published Nov 29, 2023 · Assigned by tenable
CVE-2023-49694NETGEAR ProSAFE Network Management System Privilege Escalation Via MySQL Server
High 7.8
In plain English
A high-severity improper access control in NETGEAR ProSAFE Network Management System from NETGEAR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.5%top 54.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the security context of SYSTEM.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NETGEAR | NETGEAR ProSAFE Network Management System | 0 – before 1.7.0.34 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H