PT-2025-51232 · Netsupport · Netsupport Manager

Chris Leech · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-34180

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions NetSupport Manager versions prior to 14.12.0001

Description NetSupport Manager relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. This key is stored using a reversible encoding scheme. An attacker gaining access to a deployed client configuration file can decode the stored value to recover the plaintext Gateway Key. Possession of the Gateway Key allows unauthorized access to NetSupport Manager connectivity services and enables remote control of systems managed using the same key.

Recommendations Update NetSupport Manager to version 14.12.0001 or later.

Exploit

Fix

Weakness Enumeration

CWE-257

Related Identifiers

CVE-2025-34180

Affected Products

Netsupport Manager

References · 7

• 🔥 https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34180 · Security Note
• https://twitter.com/CVEnew/status/2000611198979752220 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2000604995532566727 · Twitter Post
• https://vulncheck.com/advisories/netsupport-manager-gateway-key-reversible-encoding-credential-recovery · Note
• https://t.me/CVEtracker/39841 · Telegram Post
• https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager · Patch, Vendor Advisory