SB2023071925 - Multiple vulnerabilities in NETGEAR NMS300

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023071925

SB2023071925 - Multiple vulnerabilities in NETGEAR NMS300

Published: July 19, 2023

Security Bulletin ID SB2023071925
Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 13% Medium 63% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Arbitrary file upload (CVE-ID: CVE-2023-38095)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the MFileUploadController class. A remote user can upload a malicious file and execute it on the server.


2) Missing Authorization (CVE-ID: CVE-2023-38102)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to missing authorization within the createUser function. A remote user can escalate privileges to resources normally protected from the user.


3) Exposed dangerous method or function (CVE-ID: CVE-2023-38101)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to an exposed dangerous function within the SettingConfigController class. A remote administrator can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) SQL injection (CVE-ID: CVE-2023-38100)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the clearAlertByIds function. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.


5) SQL injection (CVE-ID: CVE-2023-38099)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the getNodesByTopologyMapSearch function. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.


6) Arbitrary file upload (CVE-ID: CVE-2023-38098)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the UpLoadServlet class. A remote user can upload a malicious file and execute it on the server.


7) Exposed dangerous method or function (CVE-ID: CVE-2023-38097)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to an exposed dangerous function within the BkreProcessThread class. A remote administrator can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) Improper Authentication (CVE-ID: CVE-2023-38096)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests within the MyHandlerInterceptor class. A remote attacker can bypass authentication process and gain unauthorized access to the application.


Remediation

Install update from vendor's website.

References