Remote Code Execution Vulnerability in NetGain Systems Enterprise Manager
CVE-2017-16597

9.8CRITICAL

Key Information:

Vendor: Netgain Systems
Status: Netgain Systems Enterprise Manager
Vendor: CVE Published:; 23 January 2018

🔔 Create Netgain Systems Vulnerability Alert

What is CVE-2017-16597?

This flaw in NetGain Systems Enterprise Manager allows unauthorized remote attackers to execute arbitrary code. The vulnerability arises from inadequate validation of user-supplied paths while processing WRQ requests. This oversight permits attackers to manipulate file operations without authentication, ultimately executing code with Administrator privileges.

Affected Version(s)

NetGain Systems Enterprise Manager 7.2.730 build 1034

References

https://zerodayinitiative.com/advisories/ZDI-17-962

x_refsource_MISC

EPSS Score

57% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 23, 2018
Vulnerability Reserved
Nov 6, 2017

CVE-2017-16597 Data

JSON