Nomachine
Monthly
Server-side request forgery in NoMachine's nxhtd web service lets unauthenticated remote attackers make the service fetch attacker-chosen URIs in the context of the NoMachine service account. Affected installations are those exposing the nxhtd listener, described as using port 4443 by default; exploitation requires only network reachability to that service. Impact is bounded to low confidentiality and integrity, and this is a moderate-priority issue rather than a critical emergency; no public exploit was identified at time of analysis.
Local privilege escalation in NoMachine allows an attacker who already has low-privileged code execution on the host to abuse predictably generated Redis database credentials and execute arbitrary code in the context of the service account. The flaw is CWE-331 insufficient entropy in the authentication mechanism for NoMachine's bundled Redis database, rated CVSS 7.8 with a local vector requiring low privileges but no user interaction. The supplied intelligence did not include a CISA KEV entry or public exploit code, so no public exploit was identified at time of analysis; risk is bounded because an initial local foothold is mandatory and no remote network vector exists.
Heap-based buffer overflow in NoMachine's mDNS resource-record parsing enables unauthenticated, network-adjacent attackers to execute arbitrary code on affected installations, running in the context of the NoMachine service account. Exploitation requires the attacker to be on the same local link/multicast domain as the target (AV:A), with NoMachine's mDNS service discovery active and reachable; no authentication (PR:N) or user interaction (UI:N) is required, and complexity is low (AC:L), giving a CVSS 8.8 impact of high confidentiality, integrity, and availability. Originally reported through Trend Micro ZDI as ZDI-CAN-30982 (advisory ZDI-26-710), the flaw is a classic CWE-122 length-validation failure; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the practical risk is gated by the adjacency precondition rather than internet-wide reachability.
Local privilege escalation in NoMachine on Windows lets any user who can already run low-privileged code on the host obtain SYSTEM-level execution by abusing an overly permissive access-control list on a named pipe exposed by the NoMachine Device Service. The flaw is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the Device Service to be installed and running, so it cannot be used for initial access - it is a post-compromise escalation step. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields full confidentiality, integrity and availability impact as SYSTEM; the finding was reported through Trend Micro ZDI as ZDI-CAN-31213 / ZDI-26-773.
Remote code execution via OS command injection in NoMachine's web service allows authenticated remote attackers to execute arbitrary commands as the service account. The flaw, tracked by Zero Day Initiative as ZDI-CAN-30634 (ZDI-26-483), exists within the getstat command handler of the web service listening on TCP port 4000 by default, where user-supplied input is passed unsanitized to a system call. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in CISA KEV, though the CVSS score of 8.8 and full C/I/A impact make this a genuine remediation priority for any organization using NoMachine for remote access.
Argument injection in NoMachine remote desktop software before versions 9.5.7 and 8.23.2 allows a local authenticated user to inject command-line arguments and achieve high-impact compromise of confidentiality, integrity, and availability on the host. The flaw is tracked as CWE-88 (Improper Neutralization of Argument Delimiters), reported by CIRCL, and at the time of analysis there is no public exploit identified.
Local privilege escalation in NoMachine Device Server allows authenticated low-privileged attackers to execute arbitrary code with SYSTEM privileges by exploiting unsafe library loading from an unsecured search path. The vulnerability (ZDI-CAN-28494) requires prior local access but enables full system compromise through DLL hijacking or similar path manipulation. No KEV listing or public exploit identified at time of analysis. CVSS 7.8 (High) with attack vector requiring local access and low privileges (AV:L/PR:L).
Local privilege escalation in NoMachine allows authenticated low-privileged attackers to execute arbitrary code as root through improper validation of command line path parameters. The vulnerability stems from insufficient sanitization of user-supplied file paths in file operations, enabling path traversal to manipulate privileged system resources. Exploitation requires existing low-privileged code execution on the target system. CVSS 7.8 (High) reflects local attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis.
Arbitrary file deletion in NoMachine through environment variable path manipulation allows authenticated local attackers to delete system files with root privileges. Vulnerability stems from insufficient validation of user-supplied paths in file operations, enabling low-privileged users to escalate impact by removing critical files. Affects NoMachine cross-platform remote desktop software. No public exploit identified at time of analysis.
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute arbitrary code. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Enterprise Client is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Enterprise Client is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Cloud Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Cloud Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Enterprise Desktop is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Enterprise Desktop is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file, as demonstrated by a scenario where. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and earlier allows a local low privileged user to gain. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Server-side request forgery in NoMachine's nxhtd web service lets unauthenticated remote attackers make the service fetch attacker-chosen URIs in the context of the NoMachine service account. Affected installations are those exposing the nxhtd listener, described as using port 4443 by default; exploitation requires only network reachability to that service. Impact is bounded to low confidentiality and integrity, and this is a moderate-priority issue rather than a critical emergency; no public exploit was identified at time of analysis.
Local privilege escalation in NoMachine allows an attacker who already has low-privileged code execution on the host to abuse predictably generated Redis database credentials and execute arbitrary code in the context of the service account. The flaw is CWE-331 insufficient entropy in the authentication mechanism for NoMachine's bundled Redis database, rated CVSS 7.8 with a local vector requiring low privileges but no user interaction. The supplied intelligence did not include a CISA KEV entry or public exploit code, so no public exploit was identified at time of analysis; risk is bounded because an initial local foothold is mandatory and no remote network vector exists.
Heap-based buffer overflow in NoMachine's mDNS resource-record parsing enables unauthenticated, network-adjacent attackers to execute arbitrary code on affected installations, running in the context of the NoMachine service account. Exploitation requires the attacker to be on the same local link/multicast domain as the target (AV:A), with NoMachine's mDNS service discovery active and reachable; no authentication (PR:N) or user interaction (UI:N) is required, and complexity is low (AC:L), giving a CVSS 8.8 impact of high confidentiality, integrity, and availability. Originally reported through Trend Micro ZDI as ZDI-CAN-30982 (advisory ZDI-26-710), the flaw is a classic CWE-122 length-validation failure; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the practical risk is gated by the adjacency precondition rather than internet-wide reachability.
Local privilege escalation in NoMachine on Windows lets any user who can already run low-privileged code on the host obtain SYSTEM-level execution by abusing an overly permissive access-control list on a named pipe exposed by the NoMachine Device Service. The flaw is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and requires the Device Service to be installed and running, so it cannot be used for initial access - it is a post-compromise escalation step. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but successful exploitation yields full confidentiality, integrity and availability impact as SYSTEM; the finding was reported through Trend Micro ZDI as ZDI-CAN-31213 / ZDI-26-773.
Remote code execution via OS command injection in NoMachine's web service allows authenticated remote attackers to execute arbitrary commands as the service account. The flaw, tracked by Zero Day Initiative as ZDI-CAN-30634 (ZDI-26-483), exists within the getstat command handler of the web service listening on TCP port 4000 by default, where user-supplied input is passed unsanitized to a system call. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in CISA KEV, though the CVSS score of 8.8 and full C/I/A impact make this a genuine remediation priority for any organization using NoMachine for remote access.
Argument injection in NoMachine remote desktop software before versions 9.5.7 and 8.23.2 allows a local authenticated user to inject command-line arguments and achieve high-impact compromise of confidentiality, integrity, and availability on the host. The flaw is tracked as CWE-88 (Improper Neutralization of Argument Delimiters), reported by CIRCL, and at the time of analysis there is no public exploit identified.
Local privilege escalation in NoMachine Device Server allows authenticated low-privileged attackers to execute arbitrary code with SYSTEM privileges by exploiting unsafe library loading from an unsecured search path. The vulnerability (ZDI-CAN-28494) requires prior local access but enables full system compromise through DLL hijacking or similar path manipulation. No KEV listing or public exploit identified at time of analysis. CVSS 7.8 (High) with attack vector requiring local access and low privileges (AV:L/PR:L).
Local privilege escalation in NoMachine allows authenticated low-privileged attackers to execute arbitrary code as root through improper validation of command line path parameters. The vulnerability stems from insufficient sanitization of user-supplied file paths in file operations, enabling path traversal to manipulate privileged system resources. Exploitation requires existing low-privileged code execution on the target system. CVSS 7.8 (High) reflects local attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis.
Arbitrary file deletion in NoMachine through environment variable path manipulation allows authenticated local attackers to delete system files with root privileges. Vulnerability stems from insufficient validation of user-supplied paths in file operations, enabling low-privileged users to escalate impact by removing critical files. Affects NoMachine cross-platform remote desktop software. No public exploit identified at time of analysis.
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute arbitrary code. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Enterprise Client is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Enterprise Client is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Cloud Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Cloud Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Enterprise Desktop is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Enterprise Desktop is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The nxfs.sys driver in the DokanFS library 0.6.0 in NoMachine before 6.4.6 on Windows 10 allows local users to cause a denial of service (BSOD) because uninitialized memory can be read. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file, as demonstrated by a scenario where. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and earlier allows a local low privileged user to gain. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An unspecified server utility in NoMachine before 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by gaining access to local files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.