Remote Code Execution Vulnerability in NetGain Systems Enterprise Manager

CVE-2017-16606

What is CVE-2017-16606?

A remote code execution vulnerability in NetGain Systems Enterprise Manager permits attackers to execute arbitrary files. The flaw occurs in the servlet responsible for handling user input, specifically in the processing of the filename parameter. Due to inadequate validation of user-supplied paths, an attacker can exploit this vulnerability to create files that invoke code execution under an Administrator's context. Although the vulnerability requires authentication, the existing authentication mechanism can be bypassed, increasing the risk of exploitation. This issue primarily affects Enterprise Manager version 7.2.730 build 1034.

References