CVE-2024-6814: Netgear ProSAFE NMS SQL Injection RCE Flaw

CVE-2024-6814 Overview

CVE-2024-6814 is a SQL injection vulnerability in the NETGEAR ProSAFE Network Management System (NMS300) that allows authenticated remote attackers to execute arbitrary code with SYSTEM privileges. The flaw resides in the getFilterString method, which fails to properly validate user-supplied input before incorporating it into SQL queries. The Zero Day Initiative tracked this issue as ZDI-CAN-23399 and published advisory ZDI-24-901. NETGEAR addressed the vulnerability in security advisory PSV-2024-0019.

Critical Impact
Authenticated attackers can inject SQL into the getFilterString method to execute arbitrary code in the context of SYSTEM, resulting in full compromise of the NMS300 management server.

Affected Products

NETGEAR ProSAFE Network Management System (NMS300) version 1.7.0.34 (x64)
NETGEAR ProSAFE NMS300 platform components exposing the getFilterString endpoint
Downstream network devices managed by a compromised NMS300 instance

Discovery Timeline

2024-08-21 - CVE-2024-6814 published to NVD
2024-08-21 - Zero Day Initiative publishes advisory ZDI-24-901
2024-08-21 - NETGEAR publishes Security Advisory PSV-2024-0019
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6814

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the getFilterString method of the NETGEAR ProSAFE Network Management System. The method accepts a user-supplied string and concatenates it into a SQL query without adequate sanitization or parameterization. An authenticated attacker can submit crafted filter input that terminates the intended SQL statement and appends attacker-controlled SQL syntax.

Because the NMS300 backend service runs with elevated privileges, successful injection can be escalated beyond data disclosure. Attackers can chain SQL injection primitives with database features that write to disk or invoke operating system commands, ultimately achieving arbitrary code execution as SYSTEM on the Windows host. This gives full control over the management server and, by extension, the ability to push malicious configurations to every managed network device.

Root Cause

The root cause is the absence of input validation and prepared statements in the getFilterString code path. Filter values received from an authenticated HTTP request are inserted directly into a dynamically constructed SQL query string. Any single-quote, comment sequence, or SQL keyword supplied by the client becomes part of the executed statement.

Attack Vector

Exploitation requires network access to the NMS300 web interface and valid credentials for any authenticated role that can invoke the vulnerable filter endpoint. Once authenticated, the attacker issues an HTTP request containing SQL metacharacters in the parameter consumed by getFilterString. The injected payload executes inside the database engine and, through database-to-OS pivoting, produces remote code execution as SYSTEM.

No verified public exploit code has been released for CVE-2024-6814. Technical details are documented in the Zero Day Initiative Advisory ZDI-24-901.

Detection Methods for CVE-2024-6814

Indicators of Compromise

HTTP requests to NMS300 filter endpoints containing SQL metacharacters such as ', --, ;, UNION SELECT, or xp_cmdshell.
Unexpected child processes spawned by the NMS300 service or its backing database process running as SYSTEM.
New or modified files under the NMS300 installation directory or database data directory created outside of maintenance windows.
Outbound connections from the NMS300 host to unfamiliar IP addresses shortly after authenticated web sessions.

Detection Strategies

Inspect NMS300 web server access logs for getFilterString parameters containing SQL keywords, encoded quotes, or comment tokens.
Correlate authenticated NMS300 sessions with subsequent process creation events on the host, especially cmd.exe, powershell.exe, or scripting engines launched by the database or Java service.
Alert on database audit events showing dynamic query execution originating from filter-related stored procedures or functions.
Monitor for privilege changes, new local accounts, or scheduled tasks created on the NMS300 server following administrative logins.

Monitoring Recommendations

Forward NMS300 application, IIS/Tomcat, and Windows Security event logs to a centralized SIEM for correlation.
Enable command-line auditing (Event ID 4688) on the NMS300 host to capture SYSTEM-context child processes.
Restrict and log all administrative access to the NMS300 web console, including source IP and user agent fields.
Baseline normal SQL query patterns from the NMS300 service account and alert on deviations.

How to Mitigate CVE-2024-6814

Immediate Actions Required

Apply the fixed NMS300 release referenced in NETGEAR Security Advisory PSV-2024-0019 as the first priority.
Remove the NMS300 web console from any internet-exposed interface and restrict access to a management VLAN.
Rotate all NMS300 user credentials and any device credentials stored by the platform after patching.
Review authentication and database audit logs for indicators of prior exploitation before reconnecting the system to production networks.

Patch Information

NETGEAR published Security Advisory PSV-2024-0019 addressing CVE-2024-6814. Administrators should download and install the fixed NMS300 build from the NETGEAR knowledge base article. Version 1.7.0.34 (x64) is confirmed vulnerable; verify the installed build matches or exceeds the fixed version listed by NETGEAR.

Workarounds

Enforce strict network access control lists so only trusted management workstations can reach the NMS300 web interface.
Require multi-factor authentication or jump-host access for all NMS300 administrator accounts to raise the bar for authenticated exploitation.
Run the NMS300 service under the least-privileged account supported by the vendor to limit the impact of code execution.
Deploy a web application firewall in front of NMS300 with signatures blocking SQL injection patterns targeting filter parameters.

bash

# Example: restrict NMS300 web console access to a management subnet on Windows
netsh advfirewall firewall add rule name="Block NMS300 external" ^
  dir=in action=block protocol=TCP localport=8080
netsh advfirewall firewall add rule name="Allow NMS300 mgmt subnet" ^
  dir=in action=allow protocol=TCP localport=8080 remoteip=10.10.20.0/24