CVE-2023-49693 — Missing Authentication for Critical Function in Netgear Prosafe Network Management System

CWE-306 — Missing Authentication for Critical Function3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.7%
top 27.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Netgear Prosafe Network Management SystemNetgear Prosafe Network Management System
Timeline
PublishedNov 29
Latest updateNov 30

Description

NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-3836-54fg-7r66: NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated↗2023-11-30
▶
CVEList
NETGEAR ProSAFE Network Management System RCE via Unprotected Access to Java Debug Wire Protocol↗2023-11-29
▶
CVE-2023-49693 — Netgear vulnerability | cvebase