Read the docs
TI-2025-24328 Aliases CVE-2025-34179GHSA-7jfx-h9gc-8r8r

NetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure

Priority HIGH 79CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request URIs using an unsanitized SQLite query against the FileLinks table in gateway.db. By injecting SQL through the LinkName/URI value, a remote attacker can control the FileName field used by the server to read and return files from disk, resulting in arbitrary local file disclosure.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00404 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Manager (NetSupport Software): 14.12.0001

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetSupport SoftwareManagerbefore 14.12.000114.12.0001Patch availableCNA
  • Manager VendorNetSupport Software Affected before 14.12.0001 Fixed in 14.12.0001 Patch available CNA

Remediation

  • Fix · CNA Manager (NetSupport Software) Fixed in 14.12.0001

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    NetSupport Software Manager — kb.netsupportsoftware.com/knowledge-base/updating-and-secur…

    3 records Highest priority Priority HIGH 3 HIGH

    Other records, highest priority first

    • TI-2025-24330 NetSupport Manager < 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCEPriority HIGH 77
    • TI-2025-24329 NetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential RecoveryPriority HIGH 70
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34179
  2. 2026-10-03 Alias added: GHSA-7jfx-h9gc-8r8r

References

Exploit 1

Patch 1

  • TI-2025-24330 NetSupport Manager < 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCE CVSS 4.0HIGH 8.7
  • TI-2025-24329 NetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential Recovery CVSS 4.0HIGH 8.4
  • TI-2010-03938 NetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences