Security readout for executives and security teams
Plain-English summary
NetSupport Manager 14.x before 14.12.0000 has a remotely reachable memory handling flaw. An unauthenticated attacker could crash the service and may expose a small amount of memory. The main business risk is disruption of remote support operations, especially where the product is reachable from untrusted networks.
Executive priority
Treat this as a high-priority operational resilience issue. Patch or isolate exposed NetSupport Manager deployments promptly, especially where remote support access is business-critical. Urgency is high because exploitation requires no authentication, but the provided evidence does not show active exploitation or confirmed full system compromise.
Technical view
CVE-2025-34165 is a CWE-121 stack-based buffer overflow in NetSupport Manager 14.x versions before 14.12.0000. CVSS 4.0 is 8.8 with network attack vector, low complexity, no privileges, and no user interaction. Reported impacts are high availability loss and limited confidentiality impact, with no integrity impact stated.
Likely exposure
Exposure is likely limited to environments running NetSupport Manager 14.x before 14.12.0000. Risk is higher when affected systems are reachable from the internet, partner networks, or broad internal network segments. The provided sources do not identify specific ports or deployment roles.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The vulnerability is remotely reachable and unauthenticated, which increases practical concern, but the provided impact description is denial of service or limited memory disclosure rather than confirmed code execution.
Researcher notes
The public bundle identifies a stack-based overflow with CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N. Affected scope is NetSupport Manager 14.x before 14.12.0000. Avoid assuming RCE, affected ports, or exploit availability without additional vendor or advisory evidence.
Mitigation direction
- Upgrade NetSupport Manager 14.x deployments to 14.12.0000 or later.
- Prioritize systems reachable from the internet or broad internal networks.
- Restrict network access to NetSupport Manager from trusted administration paths only.
- Check NetSupport and VulnCheck guidance for any additional vendor-specific mitigations.
- Monitor affected hosts for service crashes or unexpected restarts.
Validation and detection
- Inventory NetSupport Manager installations and record exact versions.
- Flag any 14.x version earlier than 14.12.0000 as affected.
- Confirm whether affected systems are reachable from untrusted networks.
- Review remote support service logs for crash patterns or anomalous connections.
- Verify upgraded systems report version 14.12.0000 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-34165 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.netsupportmanager.com/CVE reference, VulnCheck · product
- https://www.vulncheck.com/advisories/netsupport-client-manager-buffer-overflowsCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.