CVE-2023-50231: NETGEAR ProSAFE NMS saveNodeLabel stored XSS privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS is critical (9.6) and EPSS is very high, but exploitation requires user interaction and no active exploitation is confirmed in KEV.

What it is

The saveNodeLabel method in NETGEAR ProSAFE Network Management System fails to validate user-supplied data, allowing injection of arbitrary script. Because the flaw is a stored cross-site scripting issue in a management interface, it can be used to escalate privileges on affected installations. The vendor advisory and ZDI advisory confirm the issue but the record does not list specific affected versions.

Impact

An attacker can execute script in the context of a victim user and escalate privileges to resources normally protected from that user. This can lead to compromise of the management system and any devices it controls.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges required (PR:N), but exploitation requires minimal user interaction (UI:R), meaning a victim must view or interact with the injected content. The scope is changed (S:C), so the impact can extend beyond the vulnerable component.

Exploitation

The CVE is not listed in CISA KEV and no ransomware groups are documented using it. EPSS is high at 0.53303 (98.9th percentile), indicating a meaningful probability of exploitation activity, but the record does not confirm active exploitation.

What to do

• Apply the NETGEAR security advisory patch for the NMS300 referenced in PSV-2023-0106.
• Restrict network access to the ProSAFE NMS management interface to trusted administrative networks only.
• Require administrators to use dedicated, hardened browsers and avoid browsing untrusted sites while authenticated to the NMS.
• Monitor vendor advisories for updated affected version information and additional fixes.

Detection

• Review NMS application and web server logs for suspicious saveNodeLabel requests containing script tags or unusual encoded payloads.
• Monitor for unexpected administrative actions or privilege changes originating from NMS sessions.
• Search for known XSS payload patterns in stored node labels or other NMS-managed fields.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.