What’s Vulnerable › Vulnerabilities

CVE-2023-49693: NETGEAR ProSAFE Network Management System RCE via Unprotected Access to Java Debug Wire Protocol

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-11-29 · updated 2026-06-17
• Weakness: CWE-306

Description

NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code.

Affected products

• NETGEAR ProSAFE Network Management System: before 1.7.0.34 — fixed in 1.7.0.34

How to fix

Upgrade to a fixed version: NETGEAR ProSAFE Network Management System 1.7.0.34. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000065886/Security-Advisory-for-Sensitive-Information-Disclosure-on-the-NMS300-PSV-2023-0126
• https://www.tenable.com/security/research/tra-2023-39
• https://kb.netgear.com/000065886/Security-Advisory-for-Sensitive-Information-Disclosure-on-the-NMS300-PSV-2023-0126
• https://www.tenable.com/security/research/tra-2023-39

Get alerted when CVE-2023-49693 or the next vulnerability affects your stack