CVE-2023-38096 is a critical authentication bypass vulnerability affecting NETGEAR ProSAFE Network Management System, specifically within the MyHandlerInterceptor class. This flaw allows remote, unauthenticated attackers to completely bypass the authentication mechanism due to improper implementation. With a CVSS score of 9.8 (Critical), this vulnerability poses a severe risk, enabling full compromise of confidentiality, integrity, and availability without any user interaction or prior authentication. Its high EPSS score and FAUCET Risk Score further emphasize its significant exploitability and potential impact. While not currently listed in CISA's KEV catalog, a Metasploit module exists for arbitrary file upload, indicating readily available exploit code. Despite this, there is no recorded community discussion or media coverage, suggesting a lack of public awareness regarding this critical flaw.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.7.0.20CPE matchmatch criteria | cpe:2.3:a:netgear:prosafe_network_management_system:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.