Exploitation Summary
EIP tracks 2 public exploits for CVE-2016-1524.
PoCs published by Pedro Ribeiro, including Metasploit module auxiliary/admin/http/netgear_auth_download.
AI-analyzed exploit summary This exploit demonstrates an unauthenticated arbitrary file upload vulnerability (CVE-2016-1525) in NETGEAR ProSafe NMS300, allowing remote code execution as SYSTEM via JSP upload. It also details an authenticated arbitrary file download vulnerability (CVE-2016-1524) using path traversal.
Description
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI.
Exploits (2)
This exploit demonstrates an unauthenticated arbitrary file upload vulnerability (CVE-2016-1525) in NETGEAR ProSafe NMS300, allowing remote code execution as SYSTEM via JSP upload. It also details an authenticated arbitrary file download vulnerability (CVE-2016-1524) using path traversal.
This Metasploit module exploits an authenticated file download vulnerability in NETGEAR ProSafe NMS300, allowing an attacker to download arbitrary files from the system. It includes authentication handling and directory traversal brute-forcing.
References (5)
Scores
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H