← Vulnerability feed

Vulnerability record · CVE-2024-5246 · published 23 May 2024

CVE-2024-5246: Netgear prosafe network management software 300 vulnerability

Netgear · Prosafe Network Management Software 300

NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from the use of a vulnerable version of Apache Tomcat. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22868.

8.8 CVSS 3.1 High EPSS 31% · top 1.8%
8.8CVSS 3.1 base score
31%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the product installer. The issue results from the use of a vulnerable version of Apache Tomcat. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22868.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-000 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-497/ Third Party Advisory
https://kb.netgear.com/000066164/Security-Advisory-for-Multiple-Vulnerabilities-on-the-NMS300-PSV-2024-0003-PSV-2024-000 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-497/ Third Party Advisory

Track CVE-2024-5246 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.6CVE-2016-1524NETGEAR NMS300 unrestricted file upload leads to Java code executionNETGEAR Management System NMS300 1.5.0.11 and earlier exposes multiple unrestricted file upload endpoints (fileUpload.do and lib-1.0/external/flash/f…EPSS 94%analysed8.6CVE-2016-1525NETGEAR NMS300 directory traversal in image.do allows arbitrary file readNETGEAR Management System NMS300 1.5.0.11 and earlier contains a directory traversal flaw in data/config/image.do. The realName parameter accepts .. …EPSS 75%analysed

Source: NIST National Vulnerability Database (record CVE-2024-5246), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.