CVE-2024-6813

Опубликовано: 21 авг. 2024

Источник: nvd

CVSS3: 8.8

EPSS Средний

Описание

The specific flaw exists within the getSortString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-23207.

Ссылки

https://kb.netgear.com/000066231/Security-Advisory-for-SQL-Injection-on-the-NMS300-PSV-2024-0018
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-902/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:netgear:prosafe_network_management_system:1.7.0.34:*:*:*:*:*:x64:*

EPSS

Процентиль: 93%

0.10078

Средний

8.8 High

CVSS3

8.8 High

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-xr6g-6vm5-7r58

CVSS3: 8.8

github

больше 1 года назад

NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the getSortString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-23207.

BDU:2024-05747

CVSS3: 8.8

fstec

почти 2 года назад

Уязвимость метода getSortString микропрограммного обеспечения сетевых устройств ProSAFE Network Management System (NMS300), позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 93%

0.10078

Средний

8.8 High

CVSS3

8.8 High

CVSS3

Дефекты

CWE-89