CVE-2025-34179highCWE-89

CVE-2025-34179: falha de alta gravidade em NetSupport Software Manager

NetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request URIs using an unsanitized SQLite query against the FileLinks table in gateway.db. By injecting SQL through the LinkName/URI value, a remote attacker can control the FileName field used by the server to read and return files from disk, resulting in arbitrary local file disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
NetSupport Software · Manager
CVEs relacionadas — NetSupport Software Manager

No mesmo produto, das mais perigosas para as menos.

CVE-2025-34181HIGHNetSupport Manager < 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCEEPSS 1.0%CVE-2025-34180HIGHNetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential RecoveryEPSS 0.2%