CVE-2021-27273: NETGEAR ProSAFE NMS command injection in SettingConfigController

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote pre-auth-bypass command injection yielding SYSTEM on a network management server, with high EPSS but no confirmed in-the-wild exploitation or KEV listing.

What it is

NETGEAR ProSAFE Network Management System 1.6.0.26 fails to validate the fileName parameter in the SettingConfigController class before using it in a system call, allowing OS command injection. Authentication is required but the existing authentication mechanism can be bypassed, so the flaw is reachable by remote attackers. Successful exploitation runs code as SYSTEM on the management server.

Impact

An attacker gains arbitrary code execution with SYSTEM privileges on the NMS host, giving full control of the management server and any managed network devices it administers.

Attack surface

Reached remotely over the network via the web interface; the CVSS vector shows network access with low privileges and no user interaction, and the description states the authentication mechanism can be bypassed.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.64997, 99.2nd percentile), and references are only vendor and ZDI advisories with no public exploit tag.

What to do

• Apply the NETGEAR security advisory fix for PSV-2020-0559 (kb.netgear.com/000062686) or upgrade to a corrected NMS release.
• Restrict network access to the NMS web interface to trusted management networks and block it from the internet.
• Remove or disable default and unnecessary accounts, and enforce strong unique credentials to reduce the impact of the authentication bypass.
• Monitor and alert on unexpected child processes spawned by the NMS service, especially shell or command interpreters.
• If patching is delayed, isolate the NMS host on a segmented management VLAN with strict egress filtering.

Detection

• Search NMS and web server logs for requests to SettingConfigController endpoints with suspicious fileName parameter values containing shell metacharacters.
• Alert on processes spawned by the NMS service (java, tomcat) that launch cmd.exe, powershell.exe or /bin/sh.
• Baseline normal NMS child processes and flag new or unusual executables running as SYSTEM.
• Correlate authentication-bypass attempts (failed or anomalous logins) with subsequent command execution activity on the NMS host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.