Critical · 9.8 CVE-2023-49693 EUVD-2023-53627GHSA-3836-54fg-7r66

NETGEAR ProSAFE Network Management System RCE via Unprotected Access to Java Debug Wire Protocol

Published Nov 29, 2023 · Updated Aug 2, 2024 · Assigned by tenable

Vendor: NETGEAR Product: NETGEAR ProSAFE Network Management System Category: Network devices

Description

NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code.

Affected products

Vendor	Product	Affected	Fixed
NETGEAR	NETGEAR ProSAFE Network Management System	< 1.7.0.34	1.7.0.34

References

https://www.tenable.com/security/research/tra-2023-39
https://kb.netgear.com/000065886/Security-Advisory-for-Sensitive-Information-Disclosure-on-the-NMS300-PSV-2023-0126