CVE-2023-38096

EPSS 74.93%
Published 03.05.2024 02:15:52
Last modified 06.02.2025 18:01:32
Source zdi-disclosures@trendmicro.com
Teams watchlist Login
Open Login

NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of NETGEAR ProSAFE Network Management System. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the MyHandlerInterceptor class. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-19718.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Netgear ≫ Prosafe Network Management System Version < 1.7.0.20

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	74.93%	0.988

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
zdi-disclosures@trendmicro.com	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-23-920/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-38096

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-38096

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-38096

EUVD