PT-2025-51233 · Landesk · Netsupport Manager

Chris Leech · Published 2025-12-15 · Updated 2025-12-15 · CVE-2025-34181

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NetSupport Manager versions prior to 14.12.0001

Description NetSupport Manager contains a flaw in the Connectivity Server/Gateway PUTFILE request handler that allows for arbitrary file writing. An attacker possessing a valid Gateway Key can exploit this by providing a specially crafted filename with directory traversal sequences. This enables the attacker to write files to arbitrary locations on the server, potentially including the placement of malicious DLLs or executables in privileged directories. Successful exploitation can lead to remote code execution within the context of the NetSupport Manager connectivity service.

Recommendations Update NetSupport Manager to version 14.12.0001 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-34181

Affected Products

Netsupport Manager

References · 7

• 🔥 https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34181 · Security Note
• https://vulncheck.com/advisories/netsupport-manager-authenticated-path-traversal-arbitrary-write-rce · Note
• https://twitter.com/CVEnew/status/2000611197926945035 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2000597315820650727 · Twitter Post
• https://t.me/CVEtracker/39842 · Telegram Post
• https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager · Patch, Vendor Advisory