CVE-2019-16072

CRITICAL EXPLOITED IN THE WILD NUCLEI

NETSAS Enigma NMS <65.0.0 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-16072 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit from researchers including xerubus. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit leverages an OS command injection vulnerability in Enigma NMS via the `discover_and_manage.cgi` endpoint. It crafts a malicious SNMP browser request to execute a reverse shell payload hosted on an attacker-controlled web server.

Description

An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.

Exploits (1)

exploitdb WORKING POC
by xerubus · pythonwebappsmultiple
https://www.exploit-db.com/exploits/47364

This exploit leverages an OS command injection vulnerability in Enigma NMS via the `discover_and_manage.cgi` endpoint. It crafts a malicious SNMP browser request to execute a reverse shell payload hosted on an attacker-controlled web server.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: NETSAS Enigma NMS 65.0.0
Auth required
Prerequisites: Network access to Enigma NMS · Valid credentials for authentication · Attacker-controlled web server to host payload
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Enigma NMS < 65.0.0 - Authenticated OS Command Injection
CRITICALby 0x_Akoko

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.mogozobo.com/?p=3647

Scores

CVSS v3 9.8
EPSS 0.2528
EPSS Percentile 97.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2019-12-13
InTheWild.io 2019-12-13
CWE
CWE-78
Status published
Products (1)
netsas/enigma_network_management_solution < 65.0.0
Published Mar 20, 2020
Tracked Since Feb 18, 2026