Netsupport
Monthly
Credential recovery in NetSupport Manager before 14.12.0001 lets an attacker who can read a deployed client configuration file decode the shared Gateway Key, because it is stored with a reversible encoding rather than a protected or one-way representation (CWE-257). Recovering that key grants unauthorized access to the product's connectivity services and, because the same key authenticates Manager/Control, Client and Connectivity Server components, enables remote control of every system managed under it. Exploitation is not confirmed actively exploited (not listed in CISA KEV) and does not amount to a mass-exploitation emergency, but the bar is low: the primary precondition is any read access to a config file (an endpoint, a deployment share, a backup or a golden image), and a public technical writeup describing the Gateway exploitation path is available. Scored 8.4 under CVSS v4.0 and assessed at CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, this is a credible, moderate-to-high priority issue bounded to systems sharing the recovered key.
Credential recovery in NetSupport Manager before 14.12.0001 lets an attacker who can read a deployed client configuration file decode the shared Gateway Key, because it is stored with a reversible encoding rather than a protected or one-way representation (CWE-257). Recovering that key grants unauthorized access to the product's connectivity services and, because the same key authenticates Manager/Control, Client and Connectivity Server components, enables remote control of every system managed under it. Exploitation is not confirmed actively exploited (not listed in CISA KEV) and does not amount to a mass-exploitation emergency, but the bar is low: the primary precondition is any read access to a config file (an endpoint, a deployment share, a backup or a golden image), and a public technical writeup describing the Gateway exploitation path is available. Scored 8.4 under CVSS v4.0 and assessed at CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, this is a credible, moderate-to-high priority issue bounded to systems sharing the recovered key.