CVE-2025-34078 NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface

A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and is readable by local users. By extracting this password, an attack...

CVE-2025-34078

A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and is readable by local users. By extracting this password, an attack...

CVE-2025-34078

NSClient++ 0.5.2.35 contains a local privilege-escalation flaw when both web interface and ExternalScripts are enabled. The nsclient.ini file stores the admin password in plaintext and is readable by local users, allowing an attacker to extract the credential, authenticate to the NSClient++ web i...

CVE-2025-34078 NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface

A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and is readable by local users. By extracting this password, an attack...

CVE-2025-34078 NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface

A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and is readable by local users. By extracting this password, an attack...

CVE-2025-34079: Improper Control of Generation of Code

An authenticated remote code execution vulnerability exists in NSClient++ version 0.5.2.35 when the web interface and ExternalScripts module are enabled. A remote attacker with the administrator password can authenticate to the web interface default port 8443, inject arbitrary commands as externa...

CVE-2025-34078: Insufficiently Protected Credentials

A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and is readable by local users. By extracting this password, an attack...

NSClient++ security vulnerabilities

NSClient++ is an NSClient open source monitoring agent program for Windows systems. A security vulnerability exists in NSClient++ version 0.5.2.35, which originates from command injection and could lead to remote code execution...

NSClient++ security vulnerabilities

NSClient++ is an NSClient open source monitoring agent program for Windows systems. A security vulnerability exists in NSClient++ version 0.5.2.35, which stems from an insecure configuration that could lead to elevation of privilege...

PT-2025-27669

Name of the Vulnerable Software and Affected Versions: NSClient++ version 0.5.2.35 Description: A local privilege escalation issue exists when both the web interface and ExternalScripts features are enabled. The configuration file nsclient.ini stores the administrative password in plaintext and i...

CVE-2024-7401: Improper Authentication

Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a...

CVE-2023-4996

Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceControll...

CVE-2023-4996

Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceControll...

Code injection

Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceControll...

CVE-2023-4996 Local privilege escalation

Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceControll...

CVE-2023-4996

Netskope NSClient (versions 100 and prior) is affected. The root cause is a permissions-check flaw in user control code invoked by Windows ServiceController, which allows a malicious non-admin user to terminate the NSClient service and effectively disable the client. Documents consistently state ...

CVE-2023-4996 Local privilege escalation

Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceControll...

CVE-2023-4996: Improper Preservation of Permissions

Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceControll...

PT-2023-31425 · Netskope · Netskope Client

Name of the Vulnerable Software and Affected Versions: Netskope NSClient versions 100 and prior Description: A security issue was discovered in the NSClient product where a malicious non-admin user can disable the Netskope client using a specially-crafted package. The root cause is a user control...

Design/Logic Flaw

Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user c...