CVE-2025-34179CWE-89sql-injection

CVE-2025-34179

published December 15, 2025

CVSS
8.7
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request URIs using an unsanitized SQLite query against the FileLinks table in gateway.db. By injecting SQL through the LinkName/URI value, a remote attacker can control the FileName field used by the server to read and return files from disk, resulting in arbitrary local file disclosure.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00404 · 33.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-15T20:15Z
References (3)
https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager/ · [email protected]https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway/ · [email protected]https://www.vulncheck.com/advisories/netsupport-manager-unauthenticated-sqli-local-file-disclosure · [email protected]
EPSS history
Timeline
  • 15 DEC 14:41Z
    NetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure
    cvelistv5