Cyber Resilience

CVE-2024-6814

High

Published: 21 August 2024

Published
21 August 2024
Modified
27 August 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1008 93.2th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-6814 is a high-severity SQL Injection (CWE-89) vulnerability in Netgear Prosafe Network Management System. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-6814 is a SQL injection vulnerability in the getFilterString method of NETGEAR ProSAFE Network Management System. The flaw stems from insufficient validation of user-supplied input used to build SQL queries, enabling remote code execution as the SYSTEM account on affected installations. It carries a CVSS 3.1 score of 8.8 and is tracked under CWE-89; the issue was originally reported as ZDI-CAN-23399.

Authenticated remote attackers can exploit the vulnerability by supplying crafted input to the affected method, resulting in arbitrary code execution on the target system. No unauthenticated attack path is described.

NETGEAR has published security advisory PSV-2024-0019 addressing SQL injection in NMS300, and the Zero Day Initiative has released details under ZDI-24-901. The EPSS score remains flat at 0.1008 with no material increase observed after disclosure.

EU & UK References

Vulnerability details

NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw…

more

exists within the getFilterString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-23399.

CWE(s)
CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

netgear
prosafe network management system
1.7.0.34

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References