CVE-2023-49693

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
NETGEAR	NETGEAR ProSAFE Network Management System	< 1.7.0.34

References

https://kb.netgear.com/000065886/Security-Advisory-for-Sensitive-Information-Disclosure-on-the-NMS300-PSV-2023-0126Vendor Advisory
https://www.tenable.com/security/research/tra-2023-39Exploit, Third Party Advisory
https://kb.netgear.com/000065886/Security-Advisory-for-Sensitive-Information-Disclosure-on-the-NMS300-PSV-2023-0126Vendor Advisory
https://www.tenable.com/security/research/tra-2023-39Exploit, Third Party Advisory

Timeline

Published: Nov 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-496947.8A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP CVE-2023-496956.8OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a ne CVE-2023-496997.8Memory Corruption in IMS while calling VoLTE Streamingmedia Interface CVE-2023-49704.8The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2023-497007.5Security best practices violations, a string operation in Streamingmedia will write past the end of fixed-size destination buffer if the sou CVE-2023-497019.8Memory Corruption in SIM management while USIMPhase2init CVE-2023-497066.8Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges CVE-2023-497079.8SQLi vulnerability in S5 Register module for Joomla.CVE-2023-497089.8SQLi vulnerability in Starshop component for Joomla.CVE-2023-49717.2The Weaver Xtreme Theme Support WordPress plugin before 6.3.1 unserialises the content of an imported file, which could lead to PHP object i CVE-2023-497137.5Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially CVE-2023-497158.8A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15f