CVE-2016-1525

High

Published: 13/02/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2016-1525 is a vulnerability in the NETGEAR Management System NMS300 version 1.5.0.11 and earlier that allows for directory traversal. Remote authenticated users can read arbitrary files by using the '..' sequence in the realName parameter.

Risk Assessment

This vulnerability may lead to the exposure of sensitive data, posing a significant security risk to the organization. It allows attackers to access files that should not be available to users.

Recommendation

It is recommended to update the NETGEAR NMS300 system to the latest version to mitigate this vulnerability. Additionally, implementing mechanisms to restrict access to critical files is advisable.

Other vulnerabilities in NETGEAR Management System NMS300

CVE-2016-1524Critical
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 version 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by uploading a JSP file.

Original NVD description (English source)

Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.