CVE-2016-1524 in the critical feed json
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execut…
published 2016-02-13 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-2619
- cvss
- 9.6
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 94.1%
- EPSS 94.1% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI.
Timeline
- First public exploit (Metasploit auxiliary/admin/http/netgear_auth_download)
- Published
Exploit prediction
94.10% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/admin/http/netgear_auth_download NETGEAR ProSafe Network Management System 300 Authenticated File Download metasploit auxiliary, normal rank, 2016-02-04
- EDB-39412 Netgear NMS300 ProSafe Network Management System - Multiple Vulnerabilities webapps, 2016-02-04
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.6 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 8.3 | AV:A/AC:L/Au:N/C:C/I:C/A:C |
References
-
exploit-db.com
/exploits/39412/
exploit
-
securityfocus.com
/archive/1/537446/100/0/threaded
mailing-list
-
seclists.org
/fulldisclosure/2016/Feb/30
mailing-list
- packetstormsecurity.com /files/135618/Netgear-Pro-NMS-300-Code-Execution-File-Download.html
-
kb.cert.org
/vuls/id/777024
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2016-1524
- NVD CVE-2016-1524
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.