CVE-2019-25468:

NetGain EM Plus 10.1.68 contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary system commands.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Mar 11, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

NetGain EM Plus 10.1.68 contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary system commands.

Overview

The vulnerability in NetGain EM Plus 10.1.68 is a severe security issue that allows remote attackers to execute arbitrary code on the affected system without authentication. This type of vulnerability is particularly dangerous as it provides attackers with a direct path to compromise the entire system. The attack vector is network-based, requiring no user interaction or privileges, making it highly exploitable. The impact of successful exploitation is significant, potentially leading to complete system takeover, data theft, or service disruption. The vulnerability is classified as CWE-94, which relates to improper control of generation of code.

Remediation

While specific remediation details are not provided in the CVE information, general best practices for addressing this type of vulnerability include:
1. Updating the affected NetGain EM Plus software to the latest version that addresses this vulnerability.
2. Implementing strong input validation and sanitization for all user-supplied data, especially in the script_test.jsp endpoint.
3. Applying the principle of least privilege to limit the potential impact of successful exploits.
4. Monitoring systems for suspicious activities that may indicate exploitation attempts.
5. Implementing network segmentation to isolate vulnerable systems.
6. Consulting with NetGain Systems for specific patch information or mitigation strategies.