CVE-2016-1524: NETGEAR NMS300 unrestricted file upload leads to Java code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a critical CVSS score of 9.6 and very high EPSS probability, with public exploit code available.

What it is

NETGEAR Management System NMS300 1.5.0.11 and earlier exposes multiple unrestricted file upload endpoints (fileUpload.do and lib-1.0/external/flash/fileUpload.do) that accept a JSP file without validating its type. An attacker can upload that JSP and then request it through a /null URI to run arbitrary Java code on the server.

Impact

Successful exploitation gives the attacker remote code execution in the context of the NMS300 application server, allowing full compromise of the management host and any data or managed devices it controls.

Attack surface

The flaw is reached over the network via the web management interface on the two upload endpoints; the CVSS vector (AV:A) indicates the attacker must be on an adjacent network segment, and no authentication or user interaction is required.

Exploitation

CVE-2016-1524 is not listed in CISA KEV, but EPSS is very high (0.941, 99.8th percentile) and public exploit code exists on Exploit-DB (39412) and Packet Storm, so exploitation is practical and likely.

What to do

• Upgrade NMS300 to a version later than 1.5.0.11 if NETGEAR provides one; treat the product as end-of-life and plan replacement if no fix exists.
• Restrict network access to the NMS300 web interface so only trusted administrative hosts on a dedicated management VLAN can reach it.
• Block or reject requests to fileUpload.do and lib-1.0/external/flash/fileUpload.do at a reverse proxy or WAF, and deny direct access to uploaded files.
• Disable or remove the Flash-based upload component if it is not required for operations.
• Monitor and alert on unexpected JSP files appearing in web-accessible directories.

Detection

• Review web server and application logs for POST requests to fileUpload.do or lib-1.0/external/flash/fileUpload.do, especially from unexpected source addresses.
• Search the NMS300 web root and upload directories for newly created .jsp files and alert on any such file.
• Monitor for requests to /null URIs or other direct requests to uploaded files that return executable content.
• Baseline normal administrative traffic to the NMS300 interface and alert on upload activity outside maintenance windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.