Multi-Stage Backdoor in NetSarang Software Products
CVE-2025-34252

9.5CRITICAL

Key Information:

Vendor: Netsarang Computer, Inc.
Status: Xmanager Enterprise; Xmanager; Xshell; Xftp
Vendor: CVE Published:; 7 October 2025

🔔 Create Netsarang Computer, Inc. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-34252?

A malicious backdoor was embedded in multiple versions of NetSarang's software applications, specifically in the nssock2.dll library. This backdoor allows attackers to execute arbitrary code and exfiltrate sensitive data through a DNS-based communication method. It generates a domain to contact a command and control server, waits for a decryption key, and unfolds a series of actions leading to remote execution capabilities. Affected software versions have been updated to remediate this security issue. Users of NetSarang software should ensure they are using the latest, patched builds to avoid potential exploitation.

Affected Version(s)

Xftp 5.0 Build 1218

Xlpd 5.0 Build 1220

Xmanager 5.0 Build 1045

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-34252 - Proof of Concept