CVE-2016-1525
HIGHNETGEAR Management System NMS300 <1.5.0.11 - Path Traversal
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2016-1525.
PoCs published by Metasploit, Pedro Ribeiro, including Metasploit module exploits/windows/http/netgear_nms_rce.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in NETGEAR ProSafe NMS300, allowing unauthenticated remote code execution as SYSTEM via a malicious JSP payload.
Description
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.
Exploits (3)
This Metasploit module exploits an arbitrary file upload vulnerability in NETGEAR ProSafe NMS300, allowing unauthenticated remote code execution as SYSTEM via a malicious JSP payload.
This exploit demonstrates an unauthenticated arbitrary file upload vulnerability (CVE-2016-1525) in NETGEAR ProSafe NMS300, allowing remote code execution as SYSTEM via JSP upload. It also details an authenticated arbitrary file download vulnerability (CVE-2016-1524) using path traversal.
This Metasploit module exploits an authentication bypass and arbitrary file upload vulnerability in NETGEAR ProSafe NMS300 to achieve remote code execution as SYSTEM. It uploads a malicious JSP file containing a base64-encoded payload, then triggers execution via a GET request.
References (8)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N