NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability

CVE-2023-38098

Summary

The vulnerability in the NETGEAR ProSAFE Network Management System arises from an insecure implementation in the UpLoadServlet class, where insufficient validation of user-supplied data allows malicious actors to upload arbitrary files. Despite requiring authentication, the current mechanism is flawed, enabling attackers to bypass it and execute arbitrary code within the SYSTEM context. This poses a significant security risk, as successful exploitation can lead to severe consequences for affected installations, compromising sensitive data and system integrity.

References