CVE-2016-1524

EPSS 94.1%

Vexday Risk Score

60Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 94.1%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Ciclo de vida

04 feb 2016Exploit Metasploit disponible

04 feb 2016PoC pública

13 feb 2016Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 3

cve_referencepacketstormsecurity.com/files/135618/Netgear-Pro-NMS-300-Code-Execution-File-Download.htmlno verificado exploitdbwww.exploit-db.com/exploits/39412no verificado cve_referencewww.exploit-db.com/exploits/39412/no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://packetstormsecurity.com/files/135618/Netgear-Pro-NMS-300-Code-Execution-File-Download.html http://seclists.org/fulldisclosure/2016/Feb/30 https://www.exploit-db.com/exploits/39412/http://www.kb.cert.org/vuls/id/777024 http://www.securityfocus.com/archive/1/537446/100/0/threaded