cvelistv5 - CVE-2025-34252

CVE-2025-34252 (GCVE-0-2025-34252)

Vulnerability from cvelistv5

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 ( https://www.cve.org/CVERecord?id=CVE-2017-20203 ) to have the year of the CVE correspond to the year of public disclosure.

Replaced by CVE-2017-20203

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-10-09T16:58:14.274Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.cve.org/CVERecord?id=CVE-2017-20203\"\u003ehttps://www.cve.org/CVERecord?id=CVE-2017-20203\u003c/a\u003e) to have the year of the CVE correspond to the year of public disclosure."
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 ( https://www.cve.org/CVERecord?id=CVE-2017-20203 ) to have the year of the CVE correspond to the year of public disclosure."
        }
      ],
      "replacedBy": [
        "CVE-2017-20203"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34252",
    "datePublished": "2025-10-07T21:01:40.739Z",
    "dateRejected": "2025-10-09T16:58:14.274Z",
    "dateReserved": "2025-04-15T19:15:22.578Z",
    "dateUpdated": "2025-10-09T16:58:14.274Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-34252\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2025-10-07T21:15:38.077\",\"lastModified\":\"2025-10-09T17:15:58.827\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 ( https://www.cve.org/CVERecord?id=CVE-2017-20203 ) to have the year of the CVE correspond to the year of public disclosure.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2025-10-09T16:58:14.274Z\"}, \"rejectedReasons\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 (\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://www.cve.org/CVERecord?id=CVE-2017-20203\\\"\u003ehttps://www.cve.org/CVERecord?id=CVE-2017-20203\u003c/a\u003e) to have the year of the CVE correspond to the year of public disclosure.\"}], \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 ( https://www.cve.org/CVERecord?id=CVE-2017-20203 ) to have the year of the CVE correspond to the year of public disclosure.\"}], \"replacedBy\": [\"CVE-2017-20203\"], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-34252\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"state\": \"REJECTED\", \"assignerShortName\": \"VulnCheck\", \"dateReserved\": \"2025-04-15T19:15:22.578Z\", \"datePublished\": \"2025-10-07T21:01:40.739Z\", \"dateUpdated\": \"2025-10-09T16:58:14.274Z\", \"dateRejected\": \"2025-10-09T16:58:14.274Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

ghsa-r7vf-6c3r-53c3

Vulnerability from github

Published

2025-10-07 21:31

Modified

2025-10-09 18:30

Severity ?

9.5 (Critical) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Details

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT record for a month‑generated domain. After receiving a decryption key, it then downloads and executes arbitrary code, creates an encrypted virtual file system (VFS) in the registry, and grants the attacker full remote code execution, data exfiltration, and persistence. NetSarang released builds for each product line that remediated the compromise: Xmanager Enterprise Build 1236, Xmanager Build 1049, Xshell Build 1326, Xftp Build 1222, and Xlpd Build 1224. Kaspersky Lab identified an instance of exploitation in the wild in August 2017.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-34252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-506"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-07T21:15:38Z",
    "severity": "CRITICAL"
  },
  "details": "NetSarang Xmanager Enterprise 5.0 Build 1232,\u00a0Xmanager 5.0 Build 1045,\u00a0Xshell 5.0 Build 1322,\u00a0Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT record for a month\u2011generated domain. After receiving a decryption key, it then downloads and executes arbitrary code, creates an encrypted virtual file system (VFS) in the registry, and grants the attacker full remote code execution, data exfiltration, and persistence. NetSarang released builds for each product line that remediated the compromise: Xmanager Enterprise Build 1236, Xmanager Build 1049, Xshell Build 1326, Xftp Build 1222, and Xlpd Build 1224. Kaspersky Lab identified an instance of exploitation in the wild in August 2017.",
  "id": "GHSA-r7vf-6c3r-53c3",
  "modified": "2025-10-09T18:30:29Z",
  "published": "2025-10-07T21:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34252"
    },
    {
      "type": "WEB",
      "url": "https://securelist.com/shadowpad-in-corporate-networks/81432"
    },
    {
      "type": "WEB",
      "url": "https://usa.kaspersky.com/about/press-releases/shadowpad-attackers-hid-backdoor-in-software-used-by-hundreds-of-large-companies-worldwide"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20181022035109/https://www.netsarang.com/news/security_exploit_in_july_18_2017_build.html"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/netsarang-malicious-backdoor-supply-chain-compromise"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

fkie_cve-2025-34252

Vulnerability from fkie_nvd

Published

2025-10-07 21:15

Modified

2025-10-09 17:15

Severity ?

Summary

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 ( https://www.cve.org/CVERecord?id=CVE-2017-20203 ) to have the year of the CVE correspond to the year of public disclosure.

References

	URL	Tags

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This vulnerability has been reassigned as CVE-2017-20203 ( https://www.cve.org/CVERecord?id=CVE-2017-20203 ) to have the year of the CVE correspond to the year of public disclosure."
    }
  ],
  "id": "CVE-2025-34252",
  "lastModified": "2025-10-09T17:15:58.827",
  "metrics": {},
  "published": "2025-10-07T21:15:38.077",
  "references": [],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Rejected"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2025-34252 (GCVE-0-2025-34252)

Vulnerability from cvelistv5

ghsa-r7vf-6c3r-53c3

Vulnerability from github

fkie_cve-2025-34252

Vulnerability from fkie_nvd

Tags

Sightings

Nomenclature