CVE-2023-38098 is a high severity (CVSS 8.8) flaw in the NETGEAR ProSAFE Network Management System (NMS300): a second unrestricted file upload that can run code as SYSTEM. NETGEAR says NMS300 is fixed in software version 1.7.0.20. Upgrade the management system to that release or later and keep it off untrusted networks.
What's affected
NETGEAR's advisory (PSV-2023-0024 to PSV-2023-0031) says the multiple vulnerabilities are on the ProSAFE Network Management System NMS300 and that it is fixed in software version 1.7.0.20. The NVD record lists the product without version limits, and the advisory text we read gives no lower bound, so treat releases before 1.7.0.20 as affected. The advisory was first published on 12 July 2023, and the NVD record dates from 3 May 2024.
The record scores this flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The advisory rates the group as High with a score range of 7.2 to 9.8, and lists a vector for each PSV number, with some needing high privileges or none. It does not say which PSV matches which CVE, so we cannot match the record to a single advisory score. Use the record score as the figure for this CVE and the advisory range as the group range.
The weakness is CWE-434 (unrestricted file upload). This is the function named by the Zero Day Initiative as UpLoadServlet, in advisory ZDI-23-918. The description adds that although authentication is required, the existing authentication mechanism can be bypassed, which is why the group carries high scores. CVE-2023-38096 is the authentication bypass. The record does not flag CISA KEV, and nothing we read says the flaw is exploited in the wild.
How to check if you're exposed
Check the version of NMS300 in its web console, or in the installed software list on the Windows or Linux host that runs it, and compare it with 1.7.0.20. Anything lower should be upgraded.
Then check who can reach it. The management system should sit on an administration network, with no route from the internet. Check firewall rules for the web and management ports, and check cloud or remote access rules.
From a host on an untrusted segment, check that the console address does not respond at all. A system that cannot be reached cannot be attacked, which buys time to schedule the upgrade.
Look at the NMS300 user list for accounts you did not create, since several flaws in this advisory affect account and privilege handling.
What to do now
- Find every NMS300 installation, including lab and test copies, and note the version.
- Upgrade to software version 1.7.0.20 or later. NETGEAR says to download the latest release from its support site and follow the release notes.
- Restrict network access to the console to named administration hosts, and remove any exposure to the internet.
- Review users and roles in NMS300 and remove unknown accounts, then rotate administrator passwords.
- Check the managed device inventory and the host operating system for signs of changes, because the advisory describes code running with SYSTEM rights in several of the flaws.
Why it matters
This is the second upload flaw in the group, in a different component than CVE-2023-38095. ZDI says the UpLoadServlet class does not validate user supplied data, allowing arbitrary files to be uploaded, and that code then runs in the context of SYSTEM. Two separate upload paths suggest the application's approach to uploads needs a deeper review, not just one patch.
The usual defence is to restrict file types, rename files, store them outside any executable path, and require strong authorization. The vendor fix in 1.7.0.20 covers this record, and you should treat the console as a high value target until it is installed.
Quick check
Which version fixes it?
NETGEAR says NMS300 is fixed in software version 1.7.0.20. The record itself gives no version.
The advisory and the record show different scores. Which is right?
Both are published. The record gives this CVE its own score, and NETGEAR gives a range of 7.2 to 9.8 for the whole group without mapping each PSV to a CVE. Use the record score for this CVE and prioritise the upgrade, which covers the whole group.
Sources
- NETGEAR security advisory PSV-2023-0024 and PSV-2023-0025
- ZDI advisory ZDI-23-918 (linked from the record; we read ZDI-23-921 from the same series)
- CVE-2023-38098 on Gold
Last reviewed: 19 October 2026.
