PT-2025-51231 · Netsupport · Netsupport Manager

Chris Leech · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-34179

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NetSupport Manager version 14.12.0001

Description NetSupport Manager contains an unauthenticated SQL injection flaw in the way its Connectivity Server/Gateway handles HTTPS requests. The server uses an unsanitized SQLite query against the FileLinks table within the gateway.db database to evaluate request URIs. An attacker can inject SQL code through the LinkName/URI value, allowing control over the FileName field. This control enables the server to read and return arbitrary local files from disk, leading to potential arbitrary local file disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-34179

Affected Products

Netsupport Manager

References · 7

• 🔥 https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34179 · Security Note
• https://twitter.com/VulmonFeeds/status/2000599875575009465 · Twitter Post
• https://twitter.com/CVEnew/status/2000611199986421953 · Twitter Post
• https://vulncheck.com/advisories/netsupport-manager-unauthenticated-sqli-local-file-disclosure · Note
• https://t.me/CVEtracker/39840 · Telegram Post
• https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager · Patch, Vendor Advisory