CVE-2023-38102 is a high severity (CVSS 8.8) flaw in the NETGEAR ProSAFE Network Management System (NMS300): a missing authorization check in the createUser function that allows privilege escalation. NETGEAR says NMS300 is fixed in software version 1.7.0.20. Upgrade the management system to that release or later and keep it off untrusted networks.
What's affected
NETGEAR's advisory (PSV-2023-0024 to PSV-2023-0031) says the multiple vulnerabilities are on the ProSAFE Network Management System NMS300 and that it is fixed in software version 1.7.0.20. The NVD record lists the product without version limits, and the advisory text we read gives no lower bound, so treat releases before 1.7.0.20 as affected. The advisory was first published on 12 July 2023, and the NVD record dates from 3 May 2024.
The record scores this flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The advisory rates the group as High with a score range of 7.2 to 9.8, and lists a vector for each PSV number, with some needing high privileges or none. It does not say which PSV matches which CVE, so we cannot match the record to a single advisory score. Use the record score as the figure for this CVE and the advisory range as the group range.
The weakness is CWE-862 (missing authorization). This is the function named by the Zero Day Initiative as createUser, in advisory ZDI-23-914. The description adds that although authentication is required, the existing authentication mechanism can be bypassed, which is why the group carries high scores. CVE-2023-38096 is the authentication bypass. The record does not flag CISA KEV, and nothing we read says the flaw is exploited in the wild.
How to check if you're exposed
Check the version of NMS300 in its web console, or in the installed software list on the Windows or Linux host that runs it, and compare it with 1.7.0.20. Anything lower should be upgraded.
Then check who can reach it. The management system should sit on an administration network, with no route from the internet. Check firewall rules for the web and management ports, and check cloud or remote access rules.
From a host on an untrusted segment, check that the console address does not respond at all. A system that cannot be reached cannot be attacked, which buys time to schedule the upgrade.
Look at the NMS300 user list for accounts you did not create, since several flaws in this advisory affect account and privilege handling.
What to do now
- Find every NMS300 installation, including lab and test copies, and note the version.
- Upgrade to software version 1.7.0.20 or later. NETGEAR says to download the latest release from its support site and follow the release notes.
- Restrict network access to the console to named administration hosts, and remove any exposure to the internet.
- Review users and roles in NMS300 and remove unknown accounts, then rotate administrator passwords.
- Check the managed device inventory and the host operating system for signs of changes, because the advisory describes code running with SYSTEM rights in several of the flaws.
Why it matters
ZDI says the createUser function allows access without a prior authorization check, which lets an attacker escalate privileges to resources normally protected from the user. In practice that means a caller who should not be able to create accounts can create one, and an extra account is the easiest persistence an attacker can ask for.
After upgrading, review the user list in NMS300 for accounts nobody can explain, and rotate administrator passwords. A planted account survives a patch. Add the console to your regular access review.
Quick check
Which version fixes it?
NETGEAR says NMS300 is fixed in software version 1.7.0.20. The record itself gives no version.
The advisory and the record show different scores. Which is right?
Both are published. The record gives this CVE its own score, and NETGEAR gives a range of 7.2 to 9.8 for the whole group without mapping each PSV to a CVE. Use the record score for this CVE and prioritise the upgrade, which covers the whole group.
Sources
- NETGEAR security advisory PSV-2023-0024 and PSV-2023-0025
- ZDI advisory ZDI-23-914 (linked from the record; we read ZDI-23-921 from the same series)
- CVE-2023-38102 on Gold
Last reviewed: 19 October 2026.
