NETSUPPORT MANAGER 0-DAY VULNERABILITIES ENABLE REMOTE CODE EXECUTION

Summary from the TLDR InfoSec newsletter

Two critical vulnerabilities in NetSupport Manager (CVE-2025-34164 and CVE-2025-34165) can be chained to achieve unauthenticated remote code execution through the software's undocumented broadcast feature, which operates on TCP port 5405 without requiring authentication. The flaws—a heap-based out-of-bounds write and a stack-based out-of-bounds read—enable attackers to bypass ASLR, perform arbitrary memory writes, and gain remote shell access, posing a significant risk to Operational Technology (OT) environments where the software is commonly deployed. Organizations should upgrade to version 14.12.0000 or later and restrict access to port 5405 as an interim mitigation.