CVE-2024-6813: Netgear ProSafe NMS RCE Vulnerability

CVE-2024-6813 Overview

CVE-2024-6813 is a SQL injection vulnerability in the NETGEAR ProSAFE Network Management System (NMS300) that leads to remote code execution. The flaw resides in the getSortString method, which fails to properly validate user-supplied input before incorporating it into SQL queries. Authenticated remote attackers can leverage this weakness to execute arbitrary code in the context of SYSTEM on affected installations. The vulnerability is tracked as [CWE-89] and was reported through the Zero Day Initiative as ZDI-CAN-23207.

Critical Impact
An authenticated remote attacker can achieve SQL injection and gain code execution with SYSTEM privileges, taking full control of the network management server and all devices it administers.

Affected Products

NETGEAR ProSAFE Network Management System (NMS300) version 1.7.0.34 (x64)
Earlier NMS300 releases sharing the vulnerable getSortString handler
Deployments exposing the NMS300 web management interface to untrusted networks

Discovery Timeline

2024-08-21 - CVE-2024-6813 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6813

Vulnerability Analysis

The vulnerability affects the getSortString method within the NMS300 web application. This method accepts a client-controlled string that is intended to influence result sorting in database queries. The application concatenates the untrusted input directly into a SQL statement without parameterization or sanitization. An authenticated attacker can craft a malicious sort parameter that alters the query structure, enabling data exfiltration, database modification, or execution of database-level commands. Because the NMS300 service runs with SYSTEM privileges on Windows hosts, successful SQL command execution escalates directly to full host compromise.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The getSortString handler builds queries through string concatenation rather than prepared statements or parameter binding. Input validation on the sort parameter is missing, allowing SQL metacharacters and stacked query syntax to pass through to the backend database.

Attack Vector

Exploitation requires network access to the NMS300 web interface and valid application credentials. After authenticating, an attacker submits a crafted HTTP request that includes malicious SQL syntax in the sort parameter processed by getSortString. The injected SQL executes on the backend database, and abuse of database procedures or file-write primitives permits code execution in the SYSTEM security context. See the Zero Day Initiative Advisory ZDI-24-902 for additional technical context.

// No verified proof-of-concept code is available.
// See the ZDI advisory for technical details on the getSortString sink.

Detection Methods for CVE-2024-6813

Indicators of Compromise

HTTP requests to NMS300 endpoints containing SQL metacharacters (', --, ;, UNION, SELECT) in sort-related parameters
Unexpected child processes spawned by the NMS300 Java or Tomcat service running as SYSTEM
New or modified files written to the NMS300 web root or temporary directories following authenticated sessions
Database log entries showing malformed or stacked SQL statements originating from the application account

Detection Strategies

Enable and review web server access logs for anomalous query strings targeting sort parameters in NMS300 URLs
Deploy database query auditing to flag statements containing unusual ORDER BY clauses or embedded control characters
Monitor for process lineage where the NMS300 service parents cmd.exe, powershell.exe, or scripting interpreters

Monitoring Recommendations

Alert on outbound network connections initiated by the NMS300 service to unexpected destinations
Track authentication events against the NMS300 application, especially failed logins followed by successful ones from the same source
Baseline normal administrative activity and flag deviations in request volume or parameter structure

How to Mitigate CVE-2024-6813

Immediate Actions Required

Apply the vendor update referenced in the NETGEAR Security Advisory PSV-2024-0018
Restrict access to the NMS300 web interface to trusted management networks only
Rotate all NMS300 application credentials and enforce strong password policies
Audit existing NMS300 accounts and remove unused or shared logins

Patch Information

NETGEAR has published a fixed release for the NMS300 platform. Administrators should consult the NETGEAR Security Advisory PSV-2024-0018 for the corrected version and upgrade instructions. Verify the installed version after upgrade to confirm the patched build is running.

Workarounds

Place the NMS300 server behind a VPN or jump host and block direct internet exposure
Apply network access control lists limiting who can reach the management port
Deploy a web application firewall with signatures for SQL injection targeting sort parameters
Reduce the privileges of the service account where feasible, though SYSTEM is the default

bash

# Example Windows Firewall rule restricting NMS300 web access to a management subnet
netsh advfirewall firewall add rule name="NMS300-Restrict" \
    dir=in action=allow protocol=TCP localport=8080 \
    remoteip=10.10.50.0/24
netsh advfirewall firewall add rule name="NMS300-BlockAll" \
    dir=in action=block protocol=TCP localport=8080