NetSupport Manager 0-Day Vulnerabilities Enable Remote Code Execution
Two critical 0-day vulnerabilities have been identified in NetSupport Manager, enabling unauthenticated remote code execution (RCE) when exploited in combination. These vulnerabilities impact version 14.10.4.0 and earlier, with patches provided in…
Two critical 0-day vulnerabilities have been identified in NetSupport Manager, enabling unauthenticated remote code execution (RCE) when exploited in combination. These vulnerabilities impact version 14.10.4.0 and earlier, with patches provided in version 14.12.0000, released on Fri, Jul 29, 2025.
CVE-2025-34164: This is a heap-based out-of-bounds write vulnerability caused by integer overflow in broadcast port allocation parameters. It arises from insufficient validation of slot size and count values in BC_ADD_PORT commands, leading to potential memory corruption on the heap. CVE-2025-34165: This stack-based out-of-bounds read vulnerability results from missing size validation. The BC_TCP_DATA command accepts a broadcast data size parameter without verifying if the source receive buffer contains adequate data. The fixed receive buffer of 0x800 bytes on the stack allows reading beyond buffer boundaries.
NetSupport Manager installations typically use TCP port 5405 for control-to-client communication. The broadcast feature commands can be exploited without authentication, allowing unauthenticated exploitation from any network position with connectivity to the client.
The vulnerabilities allow attackers to bypass Address Space Layout Randomization (ASLR) by leaking vtable pointers. This enables arbitrary memory writes and eventual code execution through sophisticated heap manipulation techniques. Attackers can overwrite critical data structures, including vtable and pseudo-code instruction pointers.
These vulnerabilities impact version 14.10.4.0 and earlier, with patches provided in version 14.12.0000, released on Fri, Jul 29, 2025.
The widespread use of NetSupport Manager in industrial control environments increases the risk, as it provides a potential pathway for lateral movement into sensitive operational technology (OT) networks.
The vulnerabilities were reported to NetSupport Ltd. on Wed, Jun 11, 2025, with fixes provided in version 14.12.0000 on Fri, Jul 29, 2025. The patches enforce authentication for all broadcast-related commands and implement comprehensive parameter validation. Organizations should upgrade to version 14.12.0000 or later immediately.
As interim measures, implement network segmentation controls, restrict access to port 5405, and monitor for suspicious broadcast protocol activity.
Based on reporting by GBHackers.