CVE-2023-50231
Published: 03 May 2024
Summary
CVE-2023-50231 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Netgear Prosafe Network Management System. Its CVSS base score is 9.6 (Critical).
Operationally, ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-50231 is a stored cross-site scripting vulnerability in the saveNodeLabel method of NETGEAR ProSAFE Network Management System. The flaw stems from insufficient validation of user-supplied input, allowing arbitrary script injection that can be leveraged for privilege escalation on affected installations. It carries a CVSS 3.1 score of 9.6 and is tracked under CWE-79; the issue was originally reported as ZDI-CAN-21838.
Remote attackers can exploit the vulnerability over the network with minimal user interaction required. Successful exploitation permits an attacker to inject and execute scripts in the context of other users, thereby gaining access to resources and privileges that would normally be restricted.
NETGEAR has published a security advisory (PSV-2023-0106) covering stored cross-site scripting on NMS300 that directs administrators to apply available updates or mitigations. The Zero Day Initiative advisory ZDI-23-1847 provides additional technical details on the same issue. The associated EPSS score has remained flat at 0.2626 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55053
Vulnerability details
NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Minimal user interaction is required to exploit this vulnerability. The specific flaw…
more
exists within the saveNodeLabel method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-21838.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.