CVE-2023-38095 is a high severity (CVSS 8.8) flaw in the NETGEAR ProSAFE Network Management System (NMS300): an unrestricted file upload that can run code as SYSTEM. NETGEAR says NMS300 is fixed in software version 1.7.0.20. Upgrade the management system to that release or later and keep it off untrusted networks.
What's affected
NETGEAR's advisory (PSV-2023-0024 to PSV-2023-0031) says the multiple vulnerabilities are on the ProSAFE Network Management System NMS300 and that it is fixed in software version 1.7.0.20. The NVD record lists the product without version limits, and the advisory text we read gives no lower bound, so treat releases before 1.7.0.20 as affected. The advisory was first published on 12 July 2023, and the NVD record dates from 3 May 2024.
The record scores this flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The advisory rates the group as High with a score range of 7.2 to 9.8, and lists a vector for each PSV number, with some needing high privileges or none. It does not say which PSV matches which CVE, so we cannot match the record to a single advisory score. Use the record score as the figure for this CVE and the advisory range as the group range.
The weakness is CWE-434 (unrestricted file upload). This is the function named by the Zero Day Initiative as MFileUploadController, in advisory ZDI-23-921. The description adds that although authentication is required, the existing authentication mechanism can be bypassed, which is why the group carries high scores. CVE-2023-38096 is the authentication bypass. The record does not flag CISA KEV, and nothing we read says the flaw is exploited in the wild.
How to check if you're exposed
Check the version of NMS300 in its web console, or in the installed software list on the Windows or Linux host that runs it, and compare it with 1.7.0.20. Anything lower should be upgraded.
Then check who can reach it. The management system should sit on an administration network, with no route from the internet. Check firewall rules for the web and management ports, and check cloud or remote access rules.
From a host on an untrusted segment, check that the console address does not respond at all. A system that cannot be reached cannot be attacked, which buys time to schedule the upgrade.
Look at the NMS300 user list for accounts you did not create, since several flaws in this advisory affect account and privilege handling.
What to do now
- Find every NMS300 installation, including lab and test copies, and note the version.
- Upgrade to software version 1.7.0.20 or later. NETGEAR says to download the latest release from its support site and follow the release notes.
- Restrict network access to the console to named administration hosts, and remove any exposure to the internet.
- Review users and roles in NMS300 and remove unknown accounts, then rotate administrator passwords.
- Check the managed device inventory and the host operating system for signs of changes, because the advisory describes code running with SYSTEM rights in several of the flaws.
Why it matters
An unrestricted file upload is a flaw where the application accepts a file without checking its type, name or destination. If the uploaded file can end up somewhere the server will run it, uploading becomes code execution. ZDI says the issue results from a lack of proper validation of user supplied data and that code runs in the context of SYSTEM, the most powerful account on Windows.
The advisory notes authentication is required but can be bypassed. Chained with the authentication bypass described in CVE-2023-38096, an outsider could reach the upload function. On a network management system that holds the keys to switches and access points, that is a serious position to give anyone.
Quick check
Which version fixes it?
NETGEAR says NMS300 is fixed in software version 1.7.0.20. The record itself gives no version.
The advisory and the record show different scores. Which is right?
Both are published. The record gives this CVE its own score, and NETGEAR gives a range of 7.2 to 9.8 for the whole group without mapping each PSV to a CVE. Use the record score for this CVE and prioritise the upgrade, which covers the whole group.
Sources
- NETGEAR security advisory PSV-2023-0024 and PSV-2023-0025
- ZDI advisory ZDI-23-921 (read for timeline and vendor statement)
- CVE-2023-38095 on Gold
Last reviewed: 19 October 2026.
