CVE-2023-38101 is a high severity (CVSS 8.8) flaw in the NETGEAR ProSAFE Network Management System (NMS300): an exposed dangerous function that allows code execution. NETGEAR says NMS300 is fixed in software version 1.7.0.20. Upgrade the management system to that release or later and keep it off untrusted networks.
What's affected
NETGEAR's advisory (PSV-2023-0024 to PSV-2023-0031) says the multiple vulnerabilities are on the ProSAFE Network Management System NMS300 and that it is fixed in software version 1.7.0.20. The NVD record lists the product without version limits, and the advisory text we read gives no lower bound, so treat releases before 1.7.0.20 as affected. The advisory was first published on 12 July 2023, and the NVD record dates from 3 May 2024.
The record scores this flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The advisory rates the group as High with a score range of 7.2 to 9.8, and lists a vector for each PSV number, with some needing high privileges or none. It does not say which PSV matches which CVE, so we cannot match the record to a single advisory score. Use the record score as the figure for this CVE and the advisory range as the group range.
The weakness is CWE-749 (exposed dangerous method or function). This is the function named by the Zero Day Initiative as SettingConfigController, in advisory ZDI-23-915. The description adds that although authentication is required, the existing authentication mechanism can be bypassed, which is why the group carries high scores. CVE-2023-38096 is the authentication bypass. The record does not flag CISA KEV, and nothing we read says the flaw is exploited in the wild.
How to check if you're exposed
Check the version of NMS300 in its web console, or in the installed software list on the Windows or Linux host that runs it, and compare it with 1.7.0.20. Anything lower should be upgraded.
Then check who can reach it. The management system should sit on an administration network, with no route from the internet. Check firewall rules for the web and management ports, and check cloud or remote access rules.
From a host on an untrusted segment, check that the console address does not respond at all. A system that cannot be reached cannot be attacked, which buys time to schedule the upgrade.
Look at the NMS300 user list for accounts you did not create, since several flaws in this advisory affect account and privilege handling.
What to do now
- Find every NMS300 installation, including lab and test copies, and note the version.
- Upgrade to software version 1.7.0.20 or later. NETGEAR says to download the latest release from its support site and follow the release notes.
- Restrict network access to the console to named administration hosts, and remove any exposure to the internet.
- Review users and roles in NMS300 and remove unknown accounts, then rotate administrator passwords.
- Check the managed device inventory and the host operating system for signs of changes, because the advisory describes code running with SYSTEM rights in several of the flaws.
Why it matters
This is the second exposed dangerous function bug in the group, after CVE-2023-38097. ZDI says the SettingConfigController class exposes a function that allows an attacker to execute code in the context of SYSTEM. A settings controller is a natural place for powerful actions, which is why every endpoint in it needs strict authorization.
The advisory says authentication can be bypassed, so settings that look admin only may not be. Upgrading is the real fix. Until then, firewall the console, check the user list and treat configuration changes you did not make as a warning sign.
Quick check
Which version fixes it?
NETGEAR says NMS300 is fixed in software version 1.7.0.20. The record itself gives no version.
The advisory and the record show different scores. Which is right?
Both are published. The record gives this CVE its own score, and NETGEAR gives a range of 7.2 to 9.8 for the whole group without mapping each PSV to a CVE. Use the record score for this CVE and prioritise the upgrade, which covers the whole group.
Sources
- NETGEAR security advisory PSV-2023-0024 and PSV-2023-0025
- ZDI advisory ZDI-23-915 (linked from the record; we read ZDI-23-921 from the same series)
- CVE-2023-38101 on Gold
Last reviewed: 19 October 2026.
