CVE-2025-34180

NetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential Recovery

8.4 High

NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An attacker who obtains access to a deployed client configuration file can decode the stored value to recover the plaintext Gateway Key. Possession of the Gateway Key allows unauthorized access to NetSupport Manager connectivity services and enables remote control of systems managed through the same key.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.18%Up 0.2 points since Dec 16, 2025

What each source reports

CVE List Score used 8.4

NetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential Recovery

Record: CVE-2025-34180
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Weakness: CWE-257
Updated: 2026-11-02

EUVDEUVD-2025-203379 8.4

Record: EUVD-2025-203379
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-635w-84xv-8jjv 8.4

NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between...

Record: GHSA-635w-84xv-8jjv
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-257
Updated: 2026-11-02

NVD 8.4

Record: CVE-2025-34180
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-257
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-34180 is a high vulnerability (CVSS 8.4) in Manager-io Manager, published December 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. No source names a fixed version.