Remote Code Execution Vulnerability in NetGain Systems Enterprise Manager
CVE-2017-16602

8.8HIGH

Key Information:

Vendor

Netgain Systems

Status
Netgain Systems Enterprise Manager
Vendor
CVE Published:
23 January 2018

What is CVE-2017-16602?

A vulnerability exists in NetGain Systems Enterprise Manager that enables remote attackers to execute arbitrary code. While authentication is required to exploit this flaw, attackers can bypass existing security measures due to inadequate validation of user-supplied strings within a specific servlet. This critical weakness allows execution of commands with Administrator privileges, posing significant risks to affected installations.

Affected Version(s)

NetGain Systems Enterprise Manager 7.2.730 build 1034

References

https://zerodayinitiative.com/advisories/ZDI-17-967
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.