CVE-2024-5505 is a high severity (CVSS 8.8) directory traversal in NETGEAR ProSAFE Network Management System, in the UpLoadServlet class. An authenticated attacker can run code as SYSTEM. NETGEAR fixed it in NMS300 version 1.7.0.37, so upgrade and limit who can sign in.
What's affected
The Zero Day Initiative advisory ZDI-24-563 identifies the affected product as NETGEAR ProSAFE Network Management System. NETGEAR's own advisory PSV-2024-0008 names the NMS300 and says the issue is fixed in NMS300 version 1.7.0.37. The NVD record does not give version bounds.
The two sources label the weakness differently. ZDI calls it a directory traversal remote code execution flaw in UpLoadServlet. NETGEAR's advisory title says missing function level access control. Both point to the same identifier, ZDI-CAN-22724, so read them as two views of one issue.
Severity matches. ZDI and NVD both give 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Authentication is required. ZDI reports the vendor was told in January 2024, and the coordinated release came on 4 June 2024.
How to check if you're exposed
NMS300 is a management server you install, so check the installed version in its administration screens or in the program listing on the server, and compare it with 1.7.0.37. Anything older is affected.
Next, find where the console is reachable. A network management system usually has broad access to switches and other equipment, so it should sit on a management network, not on a user network or the internet. Test from a normal workstation whether you can open the login page.
Finally, review the account list. The flaw needs a valid login, so each unused or shared login widens exposure. Disable what you do not need.
What to do now
- Download the latest NMS300 from NETGEAR support for your model and install it, confirming version 1.7.0.37 or later.
- Restrict network access to the console to a small management segment.
- Remove unused accounts and rotate passwords for those that stay.
- If the server is reachable from the internet, treat it as a priority and close that access first.
- Review file and process activity on the server since January 2024 if you have the logs.
Why it matters
CWE-22, path traversal, means a user supplied path is used in file operations without checks, so a caller can reach outside the folder the code meant to use. ZDI states that the servlet runs in a way that lets the attacker execute code as SYSTEM, which is the top privilege on Windows.
That combination is what lifts a login required bug to 8.8. Management servers hold credentials and maps of your network, so a compromise reaches far beyond the server. The record is not in CISA KEV and neither source reports exploitation, so the urgency comes from the privilege level, not from known attacks.
Quick check
Do I need valid credentials to be affected?
Yes. ZDI says authentication is required to exploit it, and the CVSS vector scores privileges required as low.
Where do I get the fixed version?
From NETGEAR support. The advisory PSV-2024-0008 says the fix is in NMS300 1.7.0.37 and tells you to download the latest version for your product.
Sources
Last reviewed: 19 October 2026.
