CVE-2021-27272

What it actually does

CVE-2021-27272 is a path traversal flaw in NETGEAR ProSAFE Network Management System 1.6.0.26, specifically in the ReportTemplateController handling of a user-supplied path parameter. The application uses attacker-controlled path input in file deletion operations without sufficient canonicalization and validation, allowing a remote attacker to reference files outside the intended report-template directory. Although exploitation is described as requiring authentication, the product’s authentication mechanism can be bypassed, so exposed management interfaces should be treated as remotely exploitable. Successful exploitation allows arbitrary file deletion with low integrity impact and potentially high availability impact, including denial of service if application, configuration, database, or operating-system-relevant files are removed.

Why it matters to the business

An attacker who can reach the NETGEAR ProSAFE Network Management System web interface may be able to delete files needed by the management platform, causing outage, loss of configuration, failed monitoring, or interruption of network management operations. Because the EPSS score is high at 0.73766 and stable over the last 30 days, exploitation is more likely than for typical vulnerabilities even though it is not currently listed in CISA KEV and no ransomware use is reported. Organizations using this product should prioritize remediation or isolation, especially where the management interface is reachable from untrusted networks.

How an attack unfolds

An attacker first identifies an exposed NETGEAR ProSAFE Network Management System instance, then accesses the vulnerable web application functionality associated with report template handling. If authentication is enforced, the attacker attempts to use the known authentication bypass condition to reach the vulnerable controller without valid access, or uses any available low-privilege credentials. The attacker then supplies a crafted path parameter containing traversal sequences or equivalent encoded path components so the server resolves the requested deletion target outside the expected report template directory. The vulnerable ReportTemplateController fails to constrain the resolved path to an approved directory and performs the file operation. By targeting application files, configuration files, data files, or other critical local files, the attacker can degrade or disable the management system and create a denial-of-service condition.

How to fix it

Upgrade NETGEAR ProSAFE Network Management System to a vendor-provided fixed release if one is available for the deployed branch. If no fixed version is available, remove the product from service, migrate to a supported network management platform, or place the application behind strict compensating controls. At minimum, restrict access to the management interface to a dedicated administrative network or VPN, block internet exposure, enforce firewall allowlists, and require strong authentication at a reverse proxy or access gateway in front of the application. Review file-system permissions for the application service account so it cannot delete files outside directories required for normal operation. Maintain current offline backups of the management system, configuration, and device inventory so arbitrary file deletion can be recovered quickly.

How to confirm the fix worked

Confirm whether any NETGEAR ProSAFE Network Management System deployment is running version 1.6.0.26 or another build covered by the vendor advisory. Verify the management interface is not reachable from the internet or untrusted networks using external exposure scans and firewall reviews. After remediation, validate that the installed product version is no longer vulnerable or that the service has been decommissioned or isolated. Test access controls from an untrusted network path and confirm requests to management endpoints are denied before reaching the application. Review application behavior with benign path traversal test strings in the path parameter and confirm the application rejects traversal attempts without performing file operations. Confirm the application service account has least-privilege file permissions and cannot delete sensitive files outside its intended working directories.

Typical attack path

1. Scan for externally reachable NETGEAR ProSAFE Network Management System web interfaces.
2. Confirm the product/version is consistent with an affected 1.6.0.26 deployment or otherwise vulnerable build.
3. Bypass authentication or authenticate with low-privilege access if available.
4. Send a crafted request to the report template functionality with a malicious path parameter containing traversal or encoded traversal sequences.
5. Cause the server-side file deletion operation to resolve outside the intended report-template directory.
6. Delete files that affect application stability, configuration, logs, or availability.
7. Optionally repeat requests to remove additional files and prolong recovery or obscure evidence.

How to detect it

Investigate web server, reverse proxy, application, authentication, file-system audit, and endpoint telemetry for evidence of unauthorized access followed by file deletion activity. Focus on requests to report template functionality, references to ReportTemplateController, and path parameters containing traversal patterns such as ../, ..\, URL-encoded traversal, or double-encoded traversal. Correlate suspicious HTTP requests with application errors, service crashes, missing template/configuration files, unexpected restarts, and file deletion events by the NETGEAR ProSAFE NMS service account. Where file auditing is enabled, look for delete operations outside the expected application report-template directory. Review authentication logs for anomalous successful or failed login activity, session creation without normal login flow, unusual source IPs, or administrative actions from non-administrative networks. Because exploitation can cause denial of service, also review monitoring alerts for sudden application unavailability shortly after suspicious web requests.

• ReportTemplateController
• path=../
• path=..%2f
• path=..%2F
• path=..\
• path=..%5c
• path=..%5C
• path=%2e%2e%2f
• path=%2e%2e%5c
• path=%252e%252e%252f
• ../
• ..%2f
• ..%5c

What your security team should do

• Immediately inventory NETGEAR ProSAFE Network Management System deployments and identify any running version 1.6.0.26.
• Prioritize remediation because the EPSS score is high, indicating elevated likelihood of exploitation in the wild despite no current KEV listing.
• Remove internet exposure for the management interface and restrict access to trusted administrative networks or VPN-only access.
• Upgrade to a vendor-supported fixed version if available; otherwise plan decommissioning or migration to a supported management platform.
• Place compensating authentication and authorization controls in front of the application if it must remain temporarily available.
• Review web, reverse-proxy, and application logs for traversal strings in path parameters and suspicious report-template deletion activity.
• Check the application installation, configuration, report template, database, and log directories for unexpected missing files or recent deletion events.
• Ensure backups are current and restoration procedures are tested for the management platform.
• Add SIEM detections for path traversal attempts, encoded traversal patterns, and requests referencing ReportTemplateController or report template deletion behavior.