# CVE-2023-38098: NETGEAR ProSAFE - Authentication Bypass

> Live exploitation tracking for CVE-2023-38098 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-38098

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** NETGEAR ProSAFE Network Management System
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** iot, enterprise_software

## Description

NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of NETGEAR ProSAFE Network Management System. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MyHandlerInterceptor class. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.

## CrowdSec analysis

[CVE-2023-38098](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-38098) allows attackers to bypass authentication and upload malicious files to gain SYSTEM-level remote code execution in the NETGEAR ProSAFE Network Management interface.

CrowdSec has been tracking this vulnerability and its exploits since 20th of May 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-38098 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers bypass authentication in UpLoadServlet, upload a malicious JSP, and execute code as SYSTEM—resulting in full remote code execution

## Timeline

- 2024-05-03: CVE Published. CVE-2023-38098 is published to NVD.
- 2025-05-20: Rule Released. CrowdSec releases a rule to detect CVE-2023-38098 exploitation attempts against the CrowdSec Network.

## References

- https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025
- https://www.zerodayinitiative.com/advisories/ZDI-23-918/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-38098) follows observed exploitation activity for CVE-2023-38098. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.