Remote File Overwrite Vulnerability in NetGain Systems Enterprise Manager

CVE-2017-16601

What is CVE-2017-16601?

The vulnerability allows attackers to overwrite arbitrary files in vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Even though the exploitation requires authentication, the authentication can be circumvented through a flaw in the servlet responsible for file operations. This issue lies within the handling of the filename parameter, where user input is not adequately validated. An attacker could potentially overwrite any files accessible to the Administrator, leading to significant security risks.

References