CVE-2016-1525: NETGEAR NMS300 directory traversal in image.do allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS (8.6) with high EPSS and public exploit code, though exploitation requires valid credentials and the product is a management system rather than internet-facing by default.

What it is

NETGEAR Management System NMS300 1.5.0.11 and earlier contains a directory traversal flaw in data/config/image.do. The realName parameter accepts .. sequences, letting a remote authenticated user read arbitrary files on the server. Because the product is a management system, exposed file contents can include credentials and configuration data.

Impact

An attacker with a valid account can read any file the application can access, exposing configuration, credential and system files. The CVSS vector rates confidentiality impact as High with scope change, so the leak can extend beyond the vulnerable component.

Attack surface

Reached over the network via HTTP requests to data/config/image.do with a crafted realName parameter. The description states remote authenticated users, so a valid account is required; no user interaction is indicated by the vector.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.75013, 99.5th percentile) and public references include Exploit-DB entries and a Rapid7 Metasploit module, indicating public exploit tooling exists.

What to do

• Upgrade NETGEAR NMS300 to a version later than 1.5.0.11, or apply the vendor fix referenced by CERT/CC VU#777024.
• If upgrade is not possible, restrict network access to the NMS300 management interface to trusted administrative networks only.
• Remove or disable unnecessary accounts and enforce least privilege so few users can reach data/config/image.do.
• Monitor and alert on traversal patterns such as .. in requests to image.do and other NMS300 endpoints.

Detection

• Search web/proxy logs for requests to data/config/image.do containing .. or encoded traversal sequences in the realName parameter.
• Alert on access to sensitive paths (for example /etc/passwd, web.config, configuration files) originating from the NMS300 host.
• Correlate NMS300 authentication events with subsequent file-read requests from the same session or source IP.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.