{"uuid": "78769355-541f-43ab-83d7-8196d41b7fd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-38098", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/netgear_nms_rce.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Ege BALCI \", \"Pedro Ribeiro \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Netgear's ProSafe NMS300 is a network management utility that runs on Windows systems.\\n          The application has multiple vulnerabilities that can allow an unauthenticated remote\\n          attacker to execute code as SYSTEM user. Vulnerabilities include authentication bypass,\\n          SQL injection, arbitrary file upload, and privilege escalation across various versions.\\n          This module is able to spawn a meterpreter session by chaining together two specific\\n          vulnerabilities inside the FileUploadController and MyHandlerInterceptor classes.\\n          This module has been tested with versions 1.5.0.2, 1.4.0.17, 1.1.0.13, 1.7.0.12, and 1.7.0.1.\", \"disclosure_date\": \"2016-02-04\", \"fullname\": \"exploit/windows/http/netgear_nms_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:31 +0000\", \"name\": \"NETGEAR ProSafe Network Management System 300 Arbitrary File Upload\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/netgear_nms_rce.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/netgear_nms_rce\", \"references\": [\"ZDI-23-920\", \"ZDI-23-918\", \"CVE-2023-38096\", \"CVE-2023-38098\", \"CVE-2016-1525\", \"US-CERT-VU-777024\", \"URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear_nms_rce.txt\", \"URL-https://seclists.org/fulldisclosure/2016/Feb/30\", \"URL-https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025\"], \"rport\": 8080, \"session_types\": false, \"targets\": [\"NETGEAR ProSafe Network Management System 300 / Windows\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:55.750381Z"}