CVE-2024-6813
Published: 21 August 2024
Summary
CVE-2024-6813 is a high-severity SQL Injection (CWE-89) vulnerability in Netgear Prosafe Network Management System. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-6813 is a SQL injection vulnerability in the getSortString method of NETGEAR ProSAFE Network Management System that permits remote code execution. The flaw stems from insufficient validation of user-supplied input used to build SQL queries, allowing an authenticated attacker to execute arbitrary code in the context of the SYSTEM account. It carries a CVSS 3.1 score of 8.8 and is tracked under CWE-89; the issue was originally reported as ZDI-CAN-23207.
An authenticated remote attacker can supply a crafted string to the affected method and leverage the resulting SQL injection to achieve code execution on the target system. Because authentication is required and the attack can be performed over the network without user interaction, the vulnerability is exploitable by any user with valid credentials to the NMS installation.
NETGEAR has published security advisory PSV-2024-0018 with remediation guidance, and the Zero Day Initiative has released technical details under ZDI-24-902. The EPSS score remains flat at 0.1008 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47837
Vulnerability details
NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw…
more
exists within the getSortString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-23207.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.