CVE-2023-41182 is a directory traversal flaw in the ZipUtils class, rated High (CVSS 8.8). It affects ProSAFE Network Management System. The fix is NMS300 version 1.7.0.20, so update and check the vendor advisory for your build. ZDI published the report as ZDI-23-1284.
What's affected
The record lists NETGEAR ProSAFE Network Management System with no version range. NETGEAR names NMS300 and says it is fixed in version 1.7.0.20. NETGEAR first published its advisory on 2023-08-22.
ZDI tracks the report as ZDI-23-1284 (ZDI-CAN-19716).
Scores disagree. The NVD record gives 8.8 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. ZDI, which reported the bug, scores it 7.2.
The difference comes from how each side rates attack requirements and scope. Plan against the higher of the two numbers until you have a reason not to.
How to check if you're exposed
Open NMS300 and read its version number, then compare it with 1.7.0.20. NETGEAR tells customers to download the latest NMS300 from its support site, so a version below 1.7.0.20 should be treated as affected.
Also check who can sign in. The flaw needs a logged-in user, although ZDI says the existing authentication can be bypassed, so a management server that is reachable from outside its admin network deserves attention first.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers application dependencies, so it will not see embedded device firmware. Track devices like this in your hardware inventory instead.
What to do now
- Record the NMS300 version on every management server.
- Upgrade to NMS300 1.7.0.20 or later, using the download steps on the NETGEAR support page.
- Limit access to the NMS300 web interface to administrator networks.
- Review the accounts that can sign in and remove any you no longer need.
Hardening steps that go beyond the advisory, such as network segmentation, are general practice and not vendor guidance for this CVE.
Why it matters
The weakness class is CWE-22: path traversal. The advisory says a user-supplied path is not validated before file operations in the ZipUtils class, and code runs in the SYSTEM context on the host.
NETGEAR titles its own advisory as a post-authentication command injection, while the record describes directory traversal. Both point to the same ZDI report, so the titles reflect different descriptions of one flaw.
The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read say it is exploited in the wild. That is not a reason to wait, only a note on urgency.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need a login?
Yes, but ZDI says the existing authentication mechanism can be bypassed, so do not rely on the login as protection.
Sources
- NVD-derived record data and Safeguard Gold entry for CVE-2023-41182
- Zero Day Initiative advisory ZDI-23-1284
- NETGEAR advisory PSV-2023-0037
Last reviewed: 19 October 2026.
