CVE-2023-44449 is a high severity SQL injection in the clearAlertByIds function of NETGEAR ProSAFE Network Management System (NMS300). It scores 8.8 and needs a login. NETGEAR says the issues are fixed in NMS300 version 1.7.0.31, so upgrade to that version or later.
What's affected
The NETGEAR advisory for PSV-2023-0114 and PSV-2023-0115, first published on 2023-11-10, covers the ProSAFE Network Management System, known as NMS300. It says the issues are fixed in NMS300 version 1.7.0.31 and strongly recommends downloading the latest version. The record does not give a lower bound for affected versions, so assume any earlier release is affected.
The flaw is in the clearAlertByIds function. Authentication is required, and a remote authenticated user can escalate privileges to resources normally protected from the user. NVD scores it 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. NETGEAR rates the pair High at 8.8 with the same vector, so the sources agree on severity.
The ZDI advisory ZDI-23-1717 (ZDI-CAN-21875) says NETGEAR has issued an update. The related record CVE-2023-44450 covers the getNodesByTopologyMapSearch function in the same product and is fixed by the same release.
The NETGEAR page names two NETGEAR identifiers for the pair of issues but does not say which belongs to which CVE, so this post does not pair them.
Weakness class: CWE-89 (SQL injection).
How to check if you're exposed
NMS300 is installed software on a server, so the version is shown in the application itself. Sign in to the NMS300 web console and open the About or system information page to read the version. If it reads lower than 1.7.0.31, it needs the update.
Also check who can reach the console. A login is required to exploit the flaw, so the number of accounts, the strength of their passwords and the network paths to the server all decide your real exposure. List the NMS300 user accounts and remove those no longer needed.
What to do now
- Find every NMS300 installation and record its version.
- Download NMS300 version 1.7.0.31 or later from NETGEAR support and follow the release notes to install it.
- Restrict network access to the NMS300 console to administrator workstations and management networks.
- Review the NMS300 user list, remove stale accounts and require strong, unique passwords.
- Back up the server and its database before upgrading, and keep the backup offline.
Why it matters
The issue is SQL injection, tracked as CWE-89. The application builds a database query from a string a user supplied, without validating it, so the user can change what the query does. In this function the advisory describes the outcome as privilege escalation.
A network management system holds credentials and topology data for the switches and access points it manages. That makes it a high value target, even when exploitation needs a login. A low privilege account that can reach the database layer may end up with far more control than its role intended. CVE-2023-44449 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
The demo below shows how a vulnerability management view helps you track a case like this, with an affected version, a fixed version and an owner.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What fixes CVE-2023-44449?
NETGEAR says NMS300 version 1.7.0.31 fixes the issues. Install that version or a later one.
Does CVE-2023-44449 need a login?
Yes. The advisory says authentication is required, so limit accounts and network access to the console.
Sources
- Gold entry for CVE-2023-44449
- NETGEAR security advisory PSV-2023-0114 and PSV-2023-0115
- ZDI advisory ZDI-23-1717
Last reviewed: 19 October 2026.
