CVE-2016-1524

EPSS 94.1%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 94.1%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

04 Feb 2016Metasploit module available

04 Feb 2016Public PoC

13 Feb 2016Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/135618/Netgear-Pro-NMS-300-Code-Execution-File-Download.htmlunverified exploitdbwww.exploit-db.com/exploits/39412unverified cve_referencewww.exploit-db.com/exploits/39412/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/135618/Netgear-Pro-NMS-300-Code-Execution-File-Download.html http://seclists.org/fulldisclosure/2016/Feb/30 https://www.exploit-db.com/exploits/39412/http://www.kb.cert.org/vuls/id/777024 http://www.securityfocus.com/archive/1/537446/100/0/threaded