Serious flaws found in Netgear's NMS300 network management system

Serious vulnerabilities in the Netgear NMS300 ProSafe network management system, an application used to discover, monitor and configure a wide range of network devices, can allow hackers to take control of the servers it’s running on.

The NMS300 can be installed on Windows XP, 7, 8, 10, as well as Windows Server 2003, 2008 and 2012. It allows network administrators to centrally manage network switches, routers, wireless access points, printers, network-attached storage systems, firewall appliances and other devices that support SNMP (Simple Network Management Protocol).

The software is free for managing up to 200 devices and provides an easy-to-use Web graphical interface that can be accessed remotely.

Pedro Ribeiro, a researcher with U.K.-based security consultancy Agile Information Security, found that the Web interface of the Netgear NMS300 allows unauthenticated users to upload and then execute arbitrary Java files. Since the NMS300 software runs under the system account on the underlying OS, the rogue Java code would be executed with system privileges.

Ribeiro also found a second vulnerability that would allow an attacker to force the NMS300 application to load any file from the underlying server and then make it available for download in a predictable location. This means an attacker could read any sensitive file from the server.

Ribeiro reported these issues to Netgear through the CERT Coordination Center at Carnegie Mellon University, which published an advisory about them on Wednesday. The latest NMS300 software, version 1.5.0.11, is affected and there are currently no patches available from Netgear.

CERT/CC recommends that administrators implement firewall rules to restrict access to the application’s Web interface. Exposing the NMS300 to the Internet or to untrusted local networks should be avoided, Ribeiro said in an email sent to the Full Disclosure mailing list.

The implications of these vulnerabilities can be very serious because, according to its official specifications, the NMS300 system can modify the configurations of the managed devices and even automatically install firmware updates on them. This means that attackers who compromise the NMS300 application could also potentially compromise some of the devices that it manages or to open up additional holes in the network by modifying their configurations.