CVE-2023-44449: NETGEAR ProSAFE NMS clearAlertByIds SQL injection privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS (0.526, 99th percentile) make this a serious authenticated SQL injection, though it is not in KEV and requires valid credentials.

What it is

The clearAlertByIds function in NETGEAR ProSAFE Network Management System builds SQL queries from user-supplied strings without proper validation, allowing SQL injection. An authenticated remote attacker can exploit this to escalate privileges and reach resources normally protected from their account.

Impact

An attacker with a low-privileged account gains high confidentiality, integrity and availability impact, effectively escalating to administrative-level access over the management system.

Attack surface

Reachable over the network via the NMS web interface with a low-privileged authenticated session; no user interaction is required per the CVSS vector (AV:N/AC:L/PR:L/UI:N).

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is high at 0.526 (99th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the NETGEAR security advisory fix for the NMS300 (PSV-2023-0114/PSV-2023-0115) as the first action.
• Restrict network access to the ProSAFE NMS management interface to trusted administrative networks.
• Audit and minimize accounts with access to the NMS, removing or downgrading unused low-privileged users.
• Monitor the vendor advisory and ZDI advisory for updated guidance and any revised affected versions.

Detection

• Review NMS web server and application logs for anomalous requests to the clearAlertByIds endpoint, especially SQL metacharacters in parameters.
• Alert on SQL error strings or unexpected database errors returned by the NMS application.
• Baseline normal NMS user activity and flag privilege changes or access to administrative functions by low-privileged accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.