CVE-2025-34180 | THREATINT

Description

NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An attacker who obtains access to a deployed client configuration file can decode the stored value to recover the plaintext Gateway Key. Possession of the Gateway Key allows unauthorized access to NetSupport Manager connectivity services and enables remote control of systems managed through the same key.

PUBLISHED Reserved 2025-04-15 | Published 2025-12-15 | Updated 2025-12-15 | Assigner VulnCheck

HIGH: 8.4CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Problem types

CWE-257 Storing Passwords in a Recoverable Format

Product status

Default status

unaffected

Any version before 14.12.0001

affected

Credits

Chris Leech finder

References

kb.netsupportsoftware.com/...nd-securing-netsupport-manager/ vendor-advisory patch

www.vulncheck.com/...reversible-encoding-credential-recovery third-party-advisory

ret2.me/post/2025-12-04-exploiting-netsupport-gateway/ technical-description exploit

cve.org (CVE-2025-34180)

nvd.nist.gov (CVE-2025-34180)

Download JSON