CVE-2016-1525

🗓️ 13 Feb 2016 02:00:00Reported by certccType

cve🔗 web.nvd.nist.gov👁 60 Views🌐 WEB

CVE-2016-1525 Directory traversal vulnerability in NETGEAR Management System NMS300 1.5.0.1

Reporter	Title	Published	Views	Family All 17
0day.today	Netgear ProSafe Network Management System NMS300 - Multiple Vulnerabilities	4 Feb 201600:00	–	zdt
0day.today	Netgear ProSafe Network Management System 300 - Arbitrary File Upload (Metasploit)	1 Mar 201600:00	–	zdt
Circl	CVE-2016-1525	1 Mar 201600:00	–	circl
CNVD	Netgear Management System NMS300 Directory Traversal Vulnerability	8 Feb 201600:00	–	cnvd
Check Point Advisories	Netgear ProSAFE NMS300 fileUpload.do Arbitrary File Upload (CVE-2016-1524; CVE-2016-1525)	23 May 201600:00	–	checkpoint_advisories
Cvelist	CVE-2016-1525	13 Feb 201602:00	–	cvelist
Exploit DB	Netgear NMS300 ProSafe Network Management System - Multiple Vulnerabilities	4 Feb 201600:00	–	exploitdb
Exploit DB	Netgear NMS300 ProSafe Network Management System - Arbitrary File Upload (Metasploit)	1 Mar 201600:00	–	exploitdb
exploitpack	NETGEAR NMS300 ProSafe Network Management System - Multiple Vulnerabilities	4 Feb 201600:00	–	exploitpack
Metasploit	NETGEAR ProSafe Network Management System 300 Arbitrary File Upload	3 Feb 201623:54	–	metasploit

NVD

Node

Source	Link
kb	www.kb.cert.org/vuls/id/777024
securityfocus	www.securityfocus.com/archive/1/537446/100/0/threaded
packetstormsecurity	www.packetstormsecurity.com/files/135618/Netgear-Pro-NMS-300-Code-Execution-File-Download.html
packetstormsecurity	www.packetstormsecurity.com/files/135999/NETGEAR-ProSafe-Network-Management-System-300-Arbitrary-File-Upload.html
rapid7	www.rapid7.com/db/modules/exploit/windows/http/netgear_nms_rce
exploit-db	www.exploit-db.com/exploits/39412/
exploit-db	www.exploit-db.com/exploits/39515/
seclists	www.seclists.org/fulldisclosure/2016/Feb/30

Parameter	Position	Path	Description	CWE
realName	request body	data/config/image.do?method=add	Path traversal used to reference arbitrary files for download	CWE-22
everyPage	request body	data/getPage.do?method=getPageList&type=configImgManager	Retrieve list to locate imageId for downloaded file	CWE-22
imageId	path	data/config/image.do?method=export&imageId=<ID>	Download of arbitrary file via imageId parameter	CWE-22
realName	request body	data/config/image.do?method=add	Path traversal used to reference arbitrary files for download	CWE-22
everyPage	request body	data/getPage.do?method=getPageList&type=configImgManager	Retrieve list to locate imageId for downloaded file	CWE-22
imageId	path	data/config/image.do?method=export&imageId=<ID>	Download of arbitrary file via imageId parameter	CWE-22
name	request body	fileUpload.do	Arbitrary file upload leading to remote code execution	CWE-20, CWE-200
Filedata	request body	fileUpload.do	Arbitrary file upload leading to remote code execution	CWE-20, CWE-200
name	request body	lib-1.0/external/flash/fileUpload.do	Arbitrary file upload leading to remote code execution	CWE-20, CWE-200
Filedata	request body	lib-1.0/external/flash/fileUpload.do	Arbitrary file upload leading to remote code execution	CWE-20, CWE-200

17 Jun 2026 00:42Current

8.4High risk

Vulners AI Score8.4

CVSS 27.8

CVSS 38.6

EPSS0.75013