Vulnerability record · CVE-2023-41182 · published 3 May 2024
CVE-2023-41182: NETGEAR ProSAFE NMS ZipUtils path traversal leads to RCE
Netgear · Prosafe Network Management System
The ZipUtils class in NETGEAR ProSAFE Network Management System fails to validate a user-supplied path before using it in file operations, allowing directory traversal. An attacker can chain this with an authentication bypass to reach the vulnerable code and execute commands as SYSTEM.
Description
NETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ZipUtils class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19716.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote pre-auth-bypass code execution as SYSTEM with a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.
What it is
The ZipUtils class in NETGEAR ProSAFE Network Management System fails to validate a user-supplied path before using it in file operations, allowing directory traversal. An attacker can chain this with an authentication bypass to reach the vulnerable code and execute commands as SYSTEM.
Impact
An attacker gains arbitrary code execution with SYSTEM privileges on the management server, giving full control of the host and any managed network devices it administers.
Attack surface
Reachable over the network via the web interface (AV:N, AC:L, PR:L, UI:N). Authentication is nominally required, but the advisory states the existing authentication mechanism can be bypassed, so the practical barrier is low.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.62287 (99.1st percentile), indicating a high modeled likelihood of exploitation.
What to do
- Apply the NETGEAR security advisory fix for PSV-2023-0037 (kb.netgear.com/000065705) as the first action.
- Restrict network access to the ProSAFE NMS management interface to trusted admin networks only.
- Change default and weak credentials and audit accounts, since the flaw is reachable after an authentication bypass.
- Monitor the NMS host for unexpected file writes and child processes spawned by the application service.
Detection
- Alert on traversal sequences (../, ..\) in requests to the NMS web interface or in archive filenames processed by ZipUtils.
- Monitor for new or modified files outside expected NMS directories, especially in system paths.
- Watch for unexpected child processes or command shells spawned by the NMS service account.
- Review NMS logs for anomalous authenticated sessions or authentication bypass attempts preceding file operations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-41182 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-41182), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
