Is CVE-2025-34180 actively exploited?

No active exploitation of CVE-2025-34180 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-34180 be exploited remotely?

No. CVE-2025-34180 requires local access to exploit.

What is the CVSS score of CVE-2025-34180?

CVE-2025-34180 has a CVSS score of 8.4 (HIGH).

HOME VULNERABILITIESCVE-2025-34180

HIGH

CVE-2025-34180

CWE-257Published: December 15, 2025· Updated: Jun 17, 2026

8.4

CVSS v3.1

Official Description

NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key is stored using a reversible encoding scheme. An attacker who obtains access to a deployed client configuration file can decode the stored value to recover the plaintext Gateway Key. Possession of the Gateway Key allows unauthorized access to NetSupport Manager connectivity services and enables remote control of systems managed through the same key.

NVD Source

Technical Analysis

CVE-2025-34180 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X