CVE-2024-5246: Netgear ProSafe NMS 300 RCE Vulnerability

CVE-2024-5246 Overview

CVE-2024-5246 is a remote code execution vulnerability in the NETGEAR ProSAFE Network Management System (NMS300). The flaw exists within the product installer, which bundles a vulnerable version of Apache Tomcat. Authenticated remote attackers can leverage this issue to execute arbitrary code in the context of SYSTEM on affected installations. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-22868 and published to the National Vulnerability Database (NVD) on May 23, 2024.

Critical Impact
Successful exploitation grants attackers full SYSTEM-level code execution on the NMS300 host, enabling complete compromise of the network management platform and any devices it administers.

Affected Products

NETGEAR ProSAFE Network Management Software 300 (NMS300) version 1.7.0.37
Installations bundling the vulnerable Apache Tomcat component
Windows hosts running the NMS300 service under SYSTEM

Discovery Timeline

2024-05-23 - CVE-2024-5246 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5246

Vulnerability Analysis

The NETGEAR ProSAFE Network Management System uses Apache Tomcat as its embedded web application server. The product installer ships an outdated Tomcat build that contains known remote code execution flaws. Because NMS300 runs its Tomcat instance under the Windows SYSTEM account, any Tomcat-level code execution primitive inherits the highest privileges available on the host.

Exploitation requires valid credentials on the NMS300 web application. Once authenticated, an attacker interacts with the exposed Tomcat endpoints to trigger the underlying flaw in the bundled server. The result is arbitrary code execution on the management server without any user interaction beyond the authenticated session. NMS300 is a high-value target because it centrally manages switches, access points, and other NETGEAR infrastructure across an enterprise.

The EPSS score of 31.3% (98th percentile) indicates elevated real-world exploitation likelihood relative to the broader CVE population.

Root Cause

The root cause is the use of a vulnerable Apache Tomcat version inside the NMS300 installer bundle. NETGEAR did not update the embedded Tomcat runtime, leaving downstream deployments exposed to Tomcat-inherited remote code execution vectors. NVD classifies the weakness as NVD-CWE-noinfo because the specific Tomcat CVE inherited by NMS300 is not enumerated in the advisory.

Attack Vector

The attack vector is network-based with low complexity and requires only low-privilege authentication. An attacker with any valid NMS300 account reaches the Tomcat web tier over HTTP or HTTPS and issues crafted requests that exercise the vulnerable component. Successful requests yield code execution in the SYSTEM context, allowing lateral movement, credential theft, and persistent implant deployment on the management server.

See the Zero Day Initiative Advisory ZDI-24-497 for the coordinated disclosure record.

Detection Methods for CVE-2024-5246

Indicators of Compromise

Unexpected child processes spawned by the NMS300 Tomcat service (for example cmd.exe, powershell.exe, or wscript.exe descending from tomcat.exe or java.exe).
New or modified .jsp or .war files under the NMS300 Tomcat webapps directory.
Outbound network connections from the Tomcat process to non-NETGEAR infrastructure.
Creation of Windows services, scheduled tasks, or local accounts by the Tomcat service account.

Detection Strategies

Baseline the NMS300 Tomcat process tree and alert on any deviation, especially interactive shell or scripting host descendants.
Monitor NMS300 authentication logs for anomalous logins followed by administrative endpoint access.
Inspect Tomcat access_log files for unusual POST requests to management or upload endpoints from unexpected source addresses.
Correlate file writes in the Tomcat webapps and work directories with subsequent process execution events.

Monitoring Recommendations

Forward NMS300 web application logs, Windows Security logs, and Sysmon process-creation events to a central analytics platform.
Alert on service account privilege use by the NMS300 host outside of documented maintenance windows.
Track outbound connections from the management server and restrict them to a known allowlist.

How to Mitigate CVE-2024-5246

Immediate Actions Required

Apply the fixed release referenced in the NETGEAR security advisory for NMS300 PSV-2024-0003 and PSV-2024-0004.
Remove NMS300 web interfaces from any internet-facing exposure and restrict access to trusted management VLANs.
Rotate all NMS300 user credentials and audit accounts for unexpected privilege changes.
Review the management server for signs of prior compromise, including unauthorized SYSTEM-level activity.

Patch Information

NETGEAR published fix guidance in the vendor advisory Security Advisory for Multiple Vulnerabilities on the NMS300 PSV-2024-0003 / PSV-2024-0004. Administrators should upgrade NMS300 to the version identified in the advisory, which replaces the bundled Apache Tomcat runtime with a non-vulnerable build.

Workarounds

Restrict NMS300 web access to a jump host or dedicated management network using firewall rules.
Disable or remove NMS300 accounts that are no longer required, and enforce strong passwords on remaining accounts.
Isolate the NMS300 server in a segmented subnet with egress filtering to prevent post-exploitation callbacks.
If patching is not immediately possible, take the NMS300 service offline until the vendor-supplied update is applied.

bash

# Example Windows firewall rule to restrict NMS300 web access to a management subnet
netsh advfirewall firewall add rule name="NMS300 Web (mgmt only)" \
  dir=in action=allow protocol=TCP localport=8080,8443 \
  remoteip=10.10.50.0/24 profile=any

netsh advfirewall firewall add rule name="NMS300 Web (block others)" \
  dir=in action=block protocol=TCP localport=8080,8443