CVE-2023-38099: NETGEAR ProSAFE NMS SQL Injection in getNodesByTopologyMapSearch Leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with SYSTEM-level RCE and a very high EPSS percentile outweigh the lack of KEV listing, though the need for (bypassable) authentication keeps it below critical.

What it is

The getNodesByTopologyMapSearch function in NETGEAR ProSAFE Network Management System fails to validate user-supplied input before building SQL queries, creating a SQL injection flaw. Because the injected query can be leveraged to run code as SYSTEM, this is a remote code execution issue rather than a data-only leak. Authentication is required but the existing authentication mechanism can be bypassed, so the practical barrier is low.

Impact

An attacker can execute arbitrary code with SYSTEM privileges on the affected NETGEAR ProSAFE Network Management System installation. That level of access allows full control of the management server and any data or downstream devices it administers.

Attack surface

The vulnerability is reached over the network through the getNodesByTopologyMapSearch function, per the CVSS vector AV:N. Authentication is nominally required (PR:L) but the description states the authentication mechanism can be bypassed, and no user interaction is needed (UI:N).

Exploitation

The record shows no CISA KEV listing and no ransomware group usage, but EPSS is high at 0.56756 (99th percentile), indicating elevated likelihood of exploitation activity. References are vendor and third-party advisories only, with no public exploit tag supplied.

What to do

• Apply the NETGEAR security advisory update for ProSAFE Network Management System (PSV-2023-0024/PSV-2023-0025) as the first action.
• If patching cannot be done immediately, restrict network access to the ProSAFE NMS management interface to trusted administrative networks only.
• Review and harden the authentication mechanism, since the advisory states it can be bypassed; do not rely on it as the sole control.
• Monitor the NMS host for unexpected processes or outbound connections, given the SYSTEM-level code execution potential.

Detection

• Inspect NMS and database logs for SQL syntax errors or unusual query patterns tied to the getNodesByTopologyMapSearch function.
• Alert on unexpected child processes or command execution spawned by the ProSAFE NMS service account or SYSTEM context.
• Monitor for anomalous outbound network connections from the NMS server that do not match normal management traffic.
• Track authentication events for bypass indicators, such as successful access without valid credentials or unusual session creation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.