CVE-2019-25468
Published: 11 March 2026
Description
NetGain EM Plus 10.1.68 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious parameters to the script_test.jsp endpoint. Attackers can send POST requests with shell commands embedded in the 'content' parameter…
more
to execute code and retrieve command output.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents code injection attacks by validating and sanitizing the 'content' parameter submitted to the script_test.jsp endpoint.
Remediates the specific remote code execution flaw in NetGain EM Plus 10.1.68 by identifying, prioritizing, and applying patches or fixes.
Protects the publicly accessible script_test.jsp endpoint from unauthorized unauthenticated access and exploitation via enforced security measures.
Security SummaryAI
CVE-2019-25468 is a remote code execution vulnerability affecting NetGain EM Plus version 10.1.68. The issue lies in the script_test.jsp endpoint, which processes POST requests insecurely. Unauthenticated attackers can submit malicious parameters, embedding arbitrary shell commands in the 'content' parameter, leading to command execution and retrieval of output. This flaw is classified under CWE-94 (Code Injection) with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The attack scenario targets systems exposing the script_test.jsp endpoint over the network. Unauthenticated remote attackers require no privileges, user interaction, or special access, making exploitation straightforward via crafted POST requests. Successful attacks allow full remote code execution, providing high-impact compromise of confidentiality, integrity, and availability, such as running system commands to escalate control over the affected NetGain EM Plus instance.
References include a VulnCheck advisory detailing the remote code execution via script_test.jsp, an Exploit-DB proof-of-concept (exploit ID 47391), and the vendor site at netgain-systems.com. These sources confirm the vulnerability's mechanics and public exploit availability but do not specify patch details or mitigation steps in the provided information.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated RCE via command injection in a public-facing web endpoint (script_test.jsp) directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary system command execution (T1059 Command and Scripting Interpreter).