Arbitrary File Write Vulnerability in NetSupport Manager by NetSupport

CVE-2025-34181

What is CVE-2025-34181?

NetSupport Manager versions before 14.12.0001 contain an arbitrary file write vulnerability in the Connectivity Server/Gateway's PUTFILE request handler. An authenticated attacker, who possesses a valid Gateway Key, can exploit this vulnerability by submitting a specially crafted filename that includes directory traversal sequences. This allows them to write files to arbitrary locations on the server. By leveraging this flaw, an attacker could potentially place malicious DLLs or executables in sensitive directories, leading to remote code execution within the context of the NetSupport Manager connectivity service.

References