CVE-2023-44450: NETGEAR ProSAFE NMS SQL Injection in getNodesByTopologyMapSearch

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityAuthenticated remote code execution as SYSTEM on a network management server with a high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.

What it is

The NETGEAR ProSAFE Network Management System fails to validate user-supplied input in the getNodesByTopologyMapSearch function before building SQL queries, allowing SQL injection that can lead to remote code execution. An authenticated attacker can run arbitrary code as SYSTEM on the affected NMS300 installation, making this a serious post-authentication compromise path for a management platform.

Impact

An attacker with valid credentials gains arbitrary code execution in the SYSTEM context on the NMS host, effectively full control of the management server. From there they could pivot to managed network devices and data.

Attack surface

Reachable over the network via the NMS web interface (AV:N, AC:L, PR:L, UI:N); authentication is required, but no user interaction beyond that is needed. The vulnerable entry point is the getNodesByTopologyMapSearch function.

Exploitation

Not listed in CISA KEV and no ransomware usage documented; EPSS is high at roughly 0.536 (98.9th percentile), and references are only vendor and third-party advisories with no public exploit tag.

What to do

• Apply the NETGEAR security advisory fix for NMS300 (PSV-2023-0114/PSV-2023-0115) as the first action.
• Restrict network access to the NMS300 management interface to trusted admin networks only.
• Enforce least privilege and strong unique credentials for NMS accounts, and audit for shared or default logins.
• If patching is delayed, isolate the NMS host on a segmented management VLAN with monitoring.
• Review NMS logs for unexpected queries or process activity on the host.

Detection

• Monitor NMS300 web logs for anomalous requests to the topology map search endpoint, especially SQL metacharacters or UNION/stacked query patterns.
• Alert on unexpected child processes or command shells spawned by the NMS service account or SYSTEM on the NMS host.
• Baseline and alert on outbound connections from the NMS server to unusual destinations.
• Audit authentication logs for logins from new or unusual source addresses to the NMS interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.