CVE-2017-16603: NetGain Enterprise Manager file upload flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.8 and a very high EPSS percentile indicate a severe, remotely exploitable flaw with likely exploitation activity, though it is not in KEV.

What it is

NetGain Systems Enterprise Manager 7.2.730 build 1034 fails to validate the filename parameter in the org.apache.jsp.u.jsp.settings.upload_005ffile_005fdo_jsp servlet, allowing arbitrary file upload. Because the existing authentication mechanism can be bypassed, a remote attacker can place files and execute code as Administrator.

Impact

An attacker gains remote code execution under the Administrator context, leading to full compromise of the application and its host. This can result in data theft, service disruption, and further lateral movement.

Attack surface

The flaw is reachable over the network via TCP port 8081 by default through the upload servlet. Authentication is nominally required but can be bypassed, and no user interaction is needed.

Exploitation

The CVE is not listed in CISA KEV and no ransomware groups are documented using it, but EPSS shows a 30-day probability of 0.54025 (98.953 percentile), indicating high predicted exploitation activity. The only references are the ZDI advisory and VDB entry, with no public exploit tag.

What to do

• Apply the vendor patch or upgrade NetGain Enterprise Manager to a fixed version as soon as possible.
• Restrict network access to TCP port 8081 to trusted management hosts only.
• Enforce strong authentication and fix the authentication bypass if a patch is not yet available.
• Validate and sanitize all filename parameters and restrict upload directories to non-executable locations.
• Monitor and audit file uploads and process creation on systems running Enterprise Manager.

Detection

• Inspect HTTP requests to the upload_005ffile_005fdo_jsp servlet for path traversal sequences or suspicious filenames.
• Monitor file creation in web-accessible directories for unexpected executable files.
• Alert on new process creation spawned by the Enterprise Manager service or its web server.
• Review authentication logs for bypass attempts or anomalous access to the settings upload endpoint.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.