CVE-2017-16597: NetGain Enterprise Manager WRQ filename path traversal RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable remote code execution as Administrator with a CVSS base of 9.8 and very high EPSS probability.

What it is

NetGain Systems Enterprise Manager 7.2.730 build 1034 fails to validate the Filename field when processing WRQ requests, allowing a user-supplied path to reach file operations. Because the flaw is reachable without authentication, a remote attacker can write or manipulate files and execute code as Administrator. It matters because the affected service is exposed to the network and the outcome is full host compromise.

Impact

An unauthenticated remote attacker gains arbitrary code execution under the Administrator context on the Enterprise Manager host. That yields full control of the application server and any data or credentials it holds.

Attack surface

Reached over the network via WRQ request processing, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.57295 (99th percentile), indicating elevated predicted exploitation activity.

What to do

• Apply the vendor fix for Enterprise Manager 7.2.730 build 1034 or upgrade to a supported release; confirm the patch level with NetGain Systems.
• Restrict network access to the WRQ/TFTP service to trusted management hosts only, and block it at perimeter and inter-segment boundaries.
• Run the Enterprise Manager service under a least-privilege account rather than Administrator to limit post-exploitation reach.
• Monitor vendor advisories and ZDI-17-962 for updated remediation guidance since the record lists no fixed version.

Detection

• Alert on WRQ requests containing path traversal sequences (../, ..\, absolute paths) or unusual Filename values in service logs.
• Baseline normal WRQ filenames and flag writes outside expected directories or to executable/system paths.
• Monitor for unexpected child processes or file creation spawned by the Enterprise Manager service account.
• Watch for anomalous outbound connections from the Enterprise Manager host following WRQ activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.