Remote Code Execution Vulnerability in Netgain Enterprise Manager
CVE-2017-16608

9.8CRITICAL

Key Information:

Vendor

Netgain Systems

Status
Netgain Systems Enterprise Manager
Vendor
CVE Published:
23 January 2018

What is CVE-2017-16608?

This security vulnerability in Netgain Enterprise Manager allows remote attackers to execute arbitrary code on affected installations without requiring authentication. The flaw arises from inadequate validation of user-provided inputs within the exec.jsp file, enabling attackers to exploit this weakness to run commands with the privileges of the current user. It is crucial for organizations using this software to apply timely security updates to mitigate risks and protect sensitive data.

Affected Version(s)

NetGain Systems Enterprise Manager v7.2.586 build 877

References

https://zerodayinitiative.com/advisories/ZDI-17-950
x_refsource_MISC
https://www.tenable.com/security/research/tra-2018-02
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.