Cyber Resilience

CVE-2023-44450

High

Published: 03 May 2024

Published
03 May 2024
Modified
07 February 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.3920 97.4th percentile
Risk Priority 41 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-44450 is a high-severity SQL Injection (CWE-89) vulnerability in Netgear Prosafe Network Management System. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability CVE-2023-44450 is a SQL injection issue in the getNodesByTopologyMapSearch function of NETGEAR ProSAFE Network Management System. The flaw arises from missing validation of user-supplied strings before they are incorporated into SQL queries, enabling remote code execution on affected installations.

Authenticated remote attackers can leverage the weakness to run arbitrary code in the context of the SYSTEM account. The vulnerability carries a CVSS score of 8.8 and is tracked under CWE-89.

NETGEAR has released a security advisory covering this issue along with related vulnerabilities in the NMS300 product line, while the Zero Day Initiative has published technical details originally reported as ZDI-CAN-21858. The EPSS score has remained steady at its peak value of 0.3920 with no material upward trajectory observed after disclosure.

EU & UK References

Vulnerability details

NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw…

more

exists within the getNodesByTopologyMapSearch function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21858.

CWE(s)
CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

netgear
prosafe network management system
≤ 1.7.0.31

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References