CVE-2023-38096 is a critical severity (CVSS 9.8) flaw in the NETGEAR ProSAFE Network Management System (NMS300): an authentication bypass that needs no login. NETGEAR says NMS300 is fixed in software version 1.7.0.20. Upgrade the management system to that release or later and keep it off untrusted networks.
What's affected
NETGEAR's advisory (PSV-2023-0024 to PSV-2023-0031) says the multiple vulnerabilities are on the ProSAFE Network Management System NMS300 and that it is fixed in software version 1.7.0.20. The NVD record lists the product without version limits, and the advisory text we read gives no lower bound, so treat releases before 1.7.0.20 as affected. The advisory was first published on 12 July 2023, and the NVD record dates from 3 May 2024.
The record scores this flaw 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The advisory rates the group as High with a score range of 7.2 to 9.8, and lists a vector for each PSV number, with some needing high privileges or none. It does not say which PSV matches which CVE, so we cannot match the record to a single advisory score. Use the record score as the figure for this CVE and the advisory range as the group range.
The weakness is CWE-287 (improper authentication). This is the function named by the Zero Day Initiative as MyHandlerInterceptor, in advisory ZDI-23-920. The advisory describes this one as needing no authentication to exploit, and it is the reason the other flaws can be reached without an account. The record does not flag CISA KEV, and nothing we read says the flaw is exploited in the wild.
How to check if you're exposed
Check the version of NMS300 in its web console, or in the installed software list on the Windows or Linux host that runs it, and compare it with 1.7.0.20. Anything lower should be upgraded.
Then check who can reach it. The management system should sit on an administration network, with no route from the internet. Check firewall rules for the web and management ports, and check cloud or remote access rules.
From a host on an untrusted segment, check that the console address does not respond at all. A system that cannot be reached cannot be attacked, which buys time to schedule the upgrade.
Look at the NMS300 user list for accounts you did not create, since several flaws in this advisory affect account and privilege handling.
What to do now
- Find every NMS300 installation, including lab and test copies, and note the version.
- Upgrade to software version 1.7.0.20 or later. NETGEAR says to download the latest release from its support site and follow the release notes.
- Restrict network access to the console to named administration hosts, and remove any exposure to the internet.
- Review users and roles in NMS300 and remove unknown accounts, then rotate administrator passwords.
- Check the managed device inventory and the host operating system for signs of changes, because the advisory describes code running with SYSTEM rights in several of the flaws.
Why it matters
Authentication bypass is the entry point for the rest of the group. ZDI says the flaw sits in the MyHandlerInterceptor class and results from an improper implementation of the authentication mechanism, so an attacker can get past the login check without credentials. The record's vector needs no privileges and no user interaction, which is how it reaches a 9.8.
The other seven advisories in this group need an account in principle, but the advisory text says the existing authentication can be bypassed. That is the link. Patching the whole group at once, by moving to 1.7.0.20, is the only sensible plan. Anything that can reach the console should be treated as able to reach those functions.
Try it yourself
Not every flaw is equally likely to be abused. This demo shows how an exploitability check helps you decide which findings to fix first, and why an authentication bypass belongs at the top.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
NETGEAR says NMS300 is fixed in software version 1.7.0.20. The record itself gives no version.
The advisory and the record show different scores. Which is right?
Both are published. The record gives this CVE its own score, and NETGEAR gives a range of 7.2 to 9.8 for the whole group without mapping each PSV to a CVE. Use the record score for this CVE and prioritise the upgrade, which covers the whole group.
Sources
- NETGEAR security advisory PSV-2023-0024 and PSV-2023-0025
- ZDI advisory ZDI-23-920 (linked from the record; we read ZDI-23-921 from the same series)
- CVE-2023-38096 on Gold
Last reviewed: 19 October 2026.
