NetSupport Manager
CVE-2025-34180
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain deployed client config file
-
ExploitDecode reversibly-encoded Gateway Key
-
ExecutionAuthenticate to Connectivity/Gateway Server
-
ImpactRemote control managed endpoints
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Irreversible password storage
|
| Exploitation Conditions | Exploitation requires the attacker to first obtain a deployed NetSupport Manager client configuration file (local/filesystem access to a managed endpoint, a deployment share, a backup, or an image) that contains the encoded shared Gateway Key - this is the primary limiting factor and the reason for the local attack vector. The affected deployment must use the shared-Gateway-Key model for Manager/Client/Connectivity Server authentication (the product's standard connectivity mode). No user interaction is needed, and PR:L reflects that some access to the config is required rather than fully unauthenticated network reach. Impact scope is bounded to systems managed under the same recovered key; fixed in NetSupport Manager 14.12.0001. |
| Impact | This is a credible, moderate-to-high priority issue grounded in strong technical intelligence, though it is not a mass-exploitation emergency. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) is the most telling signal: exploitation is gated by LOCAL access and requires some privilege (PR:L) because the attacker must first obtain a deployed client configuration file - this is NOT a remote-unauthenticated internet-facing flaw despite the 8.4 score. The severity is driven by the subsequent-system impact (SC:H/SI:H/SA:H): once the reversibly-encoded shared Gateway Key is recovered, the attacker gains full remote control of every endpoint managed under that same key, so a single leaked config file can compromise an entire managed fleet. POC/technique is publicly available (the ret2.me writeup 'exploiting netsupport gateway' and the VulnCheck advisory), which materially raises real-world risk. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active exploitation - treat as 'exploitable and publicly documented' rather than 'actively exploited.' The CWE-257 (reversible/recoverable credential storage) accurately captures the root cause; the input's 'Authentication Bypass' tag is loose - the flaw is credential recovery that then enables unauthorized access, not a direct authentication bypass. |
| Exploit ScenarioDerived | An attacker who gains read access to a NetSupport Manager client configuration file (e.g., via a compromised endpoint, an exposed deployment share, or a stolen image/backup) extracts the reversibly-encoded Gateway Key and decodes it to plaintext using the documented scheme. With the recovered shared key, the attacker authenticates to the NetSupport Connectivity/Gateway Server and remotely controls any system managed under that key. A public technical writeup (ret2.me) and a VulnCheck advisory detailing the reversible encoding exist, lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Credential recovery in NetSupport Manager before 14.12.0001 lets an attacker who can read a deployed client configuration file decode the shared Gateway Key, because it is stored with a reversible encoding rather than a protected or one-way representation (CWE-257). Recovering that key grants unauthorized access to the product's connectivity services and, because the same key authenticates Manager/Control, Client and Connectivity Server components, enables remote control of every system managed under it. Exploitation is not confirmed actively exploited (not listed in CISA KEV) and does not amount to a mass-exploitation emergency, but the bar is low: the primary precondition is any read access to a config file (an endpoint, a deployment share, a backup or a golden image), and a public technical writeup describing the Gateway exploitation path is available. Scored 8.4 under CVSS v4.0 and assessed at CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, this is a credible, moderate-to-high priority issue bounded to systems sharing the recovered key.
RemediationAI
Vendor-released patch: upgrade to NetSupport Manager 14.12.0001 or later on every component - Manager/Control, all Clients, and the Connectivity Server - because the Gateway Key is shared, so patching only one side of the deployment does not close the exposure. Critically, upgrading alone does not invalidate a key that may already have been recovered: rotate/replace the Gateway Key after patching and redeploy client configurations so the old value is no longer accepted. See https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager/ for the vendor's update and hardening steps and https://www.vulncheck.com/advisories/netsupport-manager-gateway-key-reversible-encoding-credential-recovery for the advisory, with a public exploitation writeup at https://ret2.me/post/2025-12-04-exploiting-netsupport-gateway/. Where immediate upgrades are not possible, treat the encoded key as a plaintext secret and apply compensating controls: block read access to client configuration files for non-administrative users, and stop distributing configurations through broadly readable deployment shares, backups, or images - the trade-off is that hardened file permissions and image handling add friction to mass client deployment and imaging workflows. Restrict Connectivity Server reachability to known Manager hosts via network ACLs or firewall rules, accepting that this breaks legitimate remote administrators connecting from unlisted addresses. Enable and review Connectivity Server connection logging for unexpected Manager sessions as a detection control, acknowledging that logging detects rather than prevents abuse, and avoid reusing the same Gateway Key across security domains or customer tenants so a single recovered key cannot pivot across environments.
Affected ProductsAI
All NetSupport Manager deployments running versions earlier than 14.12.0001 that use the standard shared-Gateway-Key connectivity model across Manager/Control, Client, and Connectivity Server components. Clients are the primary artifact of exposure because the encoded key lives in the deployed client configuration file, but the risk extends to any system managed with the same key - including systems whose configuration is propagated through deployment shares, backups, or disk images. The fixed release is NetSupport Manager 14.12.0001. No CPE identifiers were provided in the available intelligence, so version matching must be done from the vendor's own build numbering. Vendor guidance for updating and securing deployments is at https://kb.netsupportsoftware.com/knowledge-base/updating-and-securing-netsupport-manager/, and the originating advisory with the reversible-encoding details is at https://www.vulncheck.com/advisories/netsupport-manager-gateway-key-reversible-encoding-credential-recovery.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NetSupport Manager uses a shared-secret authentication model: a single Gateway Key is pre-shared between the Manager/Control console, the deployed Clients, and the Connectivity Server so that these components can trust one another. CWE-257 (Storing Passwords in a Recoverable Format) is the root-cause class here - rather than hashing the secret or delegating it to the OS credential store, the product embeds the key in the client configuration using a reversible encoding (obfuscation, not cryptography). Anyone who can read that file can reverse the encoding and obtain the plaintext key. There is no per-endpoint keying or cryptographic challenge/response to fall back on, so key possession is effectively equivalent to authenticated component access. The CVSS v4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the independent v3.1 assessment (AV:L/PR:L) both reflect that the attacker must first obtain local/filesystem access to a config artifact; the Scope-Changed rating (S:C with C:H/I:H/A:H) reflects that this local read escalates into control of other systems managed under the same key. No CPE strings were supplied with the intelligence feed; the affected component set is the Manager/Control, Client, and Connectivity Server, with the flaw fixed in 14.12.0001.
Know when Netsupport gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Requires local access to a client config file (AV:L, PR:L); reversible decoding is trivial (AC:L); recovered key yields full remote control of separately-managed systems, a scope change (S:C, C/I/A:H).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An attacker who obtains access to a deployed client configuration file can decode the stored value to recover the plaintext Gateway Key. Possession of the Gateway Key allows unauthorized access to NetSupport Manager connectivity services and enables remote control of systems managed through the same key.
Executive ViewAI
A shared secret embedded in NetSupport Manager client configuration files is protected only by reversible encoding, meaning anyone who obtains one of these files - from an endpoint, a deployment share, a backup, or a gold image - can decode it and use it to authenticate as a trusted Manager/Control, Client, or Connectivity Server. Because that single key underpins the whole deployment, a successful decode can translate directly into remote control of every system managed under it, giving an attacker a scalable path from a low-privilege file read to broad, trusted administrative access across the estate. The vulnerability is rated HIGH (CVSS 8.4), affects NetSupport Manager versions before 14.12.0001, and has no vendor-released patch identified at time of analysis, so exposure is governed largely by how widely configuration files and their copies are readable.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict file-system and share permissions on deployed client configuration files, deployment shares, backups, and golden images so the Gateway Key is readable only by required service accounts; search for and sanitize exposed copies of these files; isolate the management network and limit Gateway, Connectivity Server, and Manager/Control connectivity to authorized administrative hosts; rotate/replace the shared Gateway Key and redistribute configuration through a controlled channel to invalidate any previously decoded key; monitor for anomalous client registrations and Manager/Control connections; and apply privileged access and multi-factor controls to administrator workstations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB