Description

CVE-2024-5245 is a local privilege escalation vulnerability in NETGEAR ProSAFE Network Management System. It allows attackers to escalate privileges on affected systems by exploiting default MySQL credentials. The vulnerability has a CVSS score of 7.8, indicating a high severity level. However, the SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a moderate risk. This discrepancy is due to the SVRS's integration of additional vulnerability intelligence elements, such as social media and dark web data, which provide a more comprehensive assessment of the threat.

Key Insights

• Active Exploitation: The vulnerability is actively exploited in the wild, making it a critical threat to organizations using NETGEAR ProSAFE Network Management System.
• Privilege Escalation: The vulnerability allows attackers to escalate privileges to the SYSTEM level, giving them complete control over the affected system.
• Default Credentials: The vulnerability is caused by the use of default MySQL credentials, which are easily accessible to attackers.
• Low Attack Complexity: Exploiting the vulnerability requires only low-privileged code execution on the target system, making it accessible to a wide range of attackers.

Mitigation Strategies

• Update Software: Install the latest software updates from NETGEAR to patch the vulnerability.
• Change Default Credentials: Change the default MySQL credentials to strong, unique passwords.
• Enable Two-Factor Authentication: Implement two-factor authentication for all administrative accounts to prevent unauthorized access.
• Monitor Network Traffic: Monitor network traffic for suspicious activity and investigate any anomalies promptly.

Additional Information

If you have any further questions regarding this incident, you can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information.