CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-5505

Medium Severity
Netgear
SVRS
30/100

CVSSv3
8.8/10

EPSS
0.24365/1

CVE-2024-5505: NETGEAR ProSAFE vulnerability allows attackers to remotely execute code. This Directory Traversal flaw in the UpLoadServlet class of the NETGEAR ProSAFE Network Management System allows remote attackers, with authentication, to execute arbitrary code. The system fails to properly validate user-supplied paths before using them in file operations. This allows an attacker to execute code with SYSTEM privileges.

While the CVSS score is 8.8 (High), the SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a lower level of immediate threat despite its presence In The Wild. Nevertheless, administrators should still apply available patches. Failing to remediate this could result in complete system compromise and unauthorized access to sensitive data. Due to the potential for remote code execution, this is a high-severity vulnerability that requires prompt attention from security teams.

In The Wild
CVSS:3.1
AV:N
AC:L
PR:L
UI:N
S:U
C:H
I:H
A:H
2024-06-06

2024-10-11

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-5505 | Netgear ProSAFE Network Management System UpLoadServlet path traversal
vuldb.com2024-06-05
CVE-2024-5505 | Netgear ProSAFE Network Management System UpLoadServlet path traversal | A vulnerability was found in Netgear ProSAFE Network Management System and classified as critical. Affected by this issue is some unknown functionality of the component UpLoadServlet. The manipulation leads to path traversal. This vulnerability is handled as CVE-2024-5505. The attack may be launched remotely. There is no exploit available. It is
vuldb.com
rss
forum
news
ZDI-24-563: NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability
2024-06-04
ZDI-24-563: NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-5505.
zerodayinitiative.com
rss
forum
news

Social Media

[CVE-2024-5505: 8.8/HIGH] Critical NETGEAR ProSAFE NMS UpLoadServlet Directory Traversal RCE Vulnerability allows remote attackers to execute arbitrary code. Authentication needed to exploit. Vulnerable UpLoadServlet class lacking... https://t.co/S3iKJyM3WC
0
0
0
[ZDI-24-563|CVE-2024-5505] NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability (CVSS 8.8) https://t.co/jyzMKxmpzk
0
0
2

Affected Software

Configuration 1
TypeVendorProduct
AppNetgearprosafe_network_management_system

References

ReferenceLink
[email protected]https://www.zerodayinitiative.com/advisories/ZDI-24-563/

CWE Details

CWE IDCWE NameDescription
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence