CVE-2023-38095: NETGEAR ProSAFE NMS unrestricted file upload leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability, SYSTEM-level code execution, and a very high EPSS score, though it is not in KEV and no public exploit is tagged.

What it is

The MFileUploadController class in NETGEAR ProSAFE Network Management System fails to validate user-supplied data, allowing upload of arbitrary files. An attacker can turn that upload into remote code execution on the affected installation. The flaw matters because it yields code execution at SYSTEM level on a management platform.

Impact

An attacker gains arbitrary code execution in the context of SYSTEM on the NETGEAR ProSAFE Network Management System. That level of access lets them fully compromise the management host and anything it controls.

Attack surface

Reachable over the network via the MFileUploadController endpoint (CVSS AV:N). Authentication is nominally required, but the description states the existing authentication mechanism can be bypassed, and no user interaction is needed (UI:N).

Exploitation

Not listed in CISA KEV and no ransomware usage documented. EPSS is high at 0.65517 (99.2nd percentile), and references are vendor and Zero Day Initiative advisories only, with no public exploit tag.

What to do

• Apply the NETGEAR security advisory fix for PSV-2023-0024/PSV-2023-0025 (kb.netgear.com/000065707) as the first action.
• If patching is delayed, restrict network access to the ProSAFE NMS management interface to trusted administrative networks only.
• Enforce strong authentication and monitor for authentication bypass attempts against the management system.
• Review and restrict file upload functionality on the NMS, and validate uploaded file types where configuration allows.
• Isolate the NMS host from other critical systems to limit lateral movement if it is compromised.

Detection

• Monitor the MFileUploadController endpoint for uploads of unexpected or executable file types.
• Alert on new or modified files in web-accessible or application directories on the NMS host.
• Watch for unexpected child processes spawned by the NMS web service, especially those running as SYSTEM.
• Correlate authentication events with upload activity to catch bypass attempts preceding file uploads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.