CVE-2024-6813 — SQL Injection in Netgear Prosafe Network Management System

CWE-89 — SQL Injection3 documents3 sources

Severity

8.8HIGHNVD

EPSS

10.1%

top 6.90%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Netgear Prosafe Network Management System

Timeline

PublishedAug 21

Description

NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the getSortString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker ca…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5netgear/prosafe_network_management_system1.7.0.34 x64

▶NVDnetgear/prosafe_network_management_system1.7.0.34

🔴Vulnerability Details

GHSA

GHSA-xr6g-6vm5-7r58: NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability↗2024-08-21

▶

CVEList

NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability↗2024-08-21

▶