CVE-2021-27275

What it actually does

The flaw is a path traversal vulnerability in NETGEAR ProSAFE Network Management System 1.6.0.26, specifically in the ConfigFileController class. The application uses the user-supplied realName parameter in file operations without properly canonicalizing and validating the path. A remote attacker can bypass the product’s authentication mechanism, supply traversal sequences or absolute path references, and cause the application to read sensitive files or delete arbitrary files accessible to the service account. The primary impact is high confidentiality loss and high availability impact, with limited integrity impact through file deletion.

Why it matters to the business

Successful exploitation can expose configuration data, credentials, keys, logs, or operating system files from the management server and can also disrupt network-management operations by deleting application or system files. Because this product is used to manage network infrastructure, compromise or outage of the management platform can impair visibility, configuration control, incident response, and operational continuity. The EPSS score is high at 0.73318 and stable over the last 30 days, indicating meaningful likelihood of exploitation even though it is not currently listed in CISA KEV and no ransomware use is reported.

How an attack unfolds

An attacker first reaches the NETGEAR ProSAFE Network Management System web interface over the network. Although the vulnerable operation is nominally authenticated, the attacker abuses weaknesses in the existing authentication mechanism to reach the affected ConfigFileController functionality without valid authorization. The attacker then submits a crafted request containing a malicious realName value with path traversal sequences such as ../ or encoded variants. If the request targets a read operation, the server resolves the attacker-controlled path outside the intended directory and returns sensitive file contents. If the request targets a delete operation, the server deletes an arbitrary file reachable by the application process, potentially corrupting the NMS installation or causing service failure. Attackers may use disclosed files to harvest credentials, understand the environment, pivot to managed devices, or perform denial of service by removing important application files.

How to fix it

Upgrade NETGEAR ProSAFE Network Management System to a vendor-supported version that corrects CVE-2021-27275. No exact fixed version was provided in the input, so consult NETGEAR advisories and release notes for the first fixed release and avoid remaining on version 1.6.0.26. If an immediate upgrade is not possible, remove internet exposure, restrict access to trusted administrative networks and VPNs, enforce network-layer allowlisting, and place the application behind strong authentication. Run the service with the least-privileged operating system account so it cannot read or delete unnecessary files. Monitor or block requests containing traversal patterns in the realName parameter using a reverse proxy or WAF. Consider retiring or replacing unsupported installations, as legacy management software often carries elevated operational risk.

How to confirm the fix worked

Confirm the deployed product version is not NETGEAR ProSAFE Network Management System 1.6.0.26 and is at or above the vendor-fixed release. Verify the web interface is not reachable from untrusted networks. Test that requests to the affected ConfigFileController functionality using realName values containing ../, ..\, URL-encoded traversal strings, absolute paths, or nested traversal sequences are rejected with an authorization or validation error and do not return file contents or delete files. Confirm application logs show blocked validation failures rather than successful file operations. Review service account permissions to ensure the application cannot access sensitive OS paths or delete files outside required application directories.

Typical attack path

1. Identify an internet-facing or internally reachable NETGEAR ProSAFE Network Management System instance, especially version 1.6.0.26.
2. Access the web application and attempt to bypass or abuse the authentication mechanism protecting controller endpoints.
3. Send crafted requests to ConfigFileController containing a malicious realName parameter with traversal payloads such as ../, ..\, or URL-encoded equivalents.
4. Read sensitive files from outside the intended configuration directory, such as application configuration, logs, credential stores, or operating system files.
5. Optionally issue file deletion requests using the same path traversal weakness to remove application, configuration, or system files accessible to the service account.
6. Use recovered information for further intrusion, or cause a denial-of-service condition by deleting files required by the management platform.

How to detect it

Review web server, application, reverse proxy, WAF, and endpoint logs for requests to the NETGEAR ProSAFE NMS ConfigFileController that include a realName parameter containing path traversal sequences, encoded traversal strings, absolute file paths, or suspicious references to sensitive files. Look for successful HTTP 200 responses with unusually large response sizes following such requests, as these may indicate file disclosure. Also investigate HTTP requests followed by application errors, service crashes, missing files, or unexpected restarts, which may indicate arbitrary file deletion. On the host, examine file integrity monitoring, EDR telemetry, and OS audit logs for deletion events initiated by the NMS application process outside expected application directories. Because exploitation may involve authentication bypass, do not limit review to requests associated with valid administrative sessions; also examine unauthenticated or anomalous session activity. If sensitive configuration files or credential stores may have been read, perform credential exposure analysis and rotate affected secrets.

• ConfigFileController
• realName=
• realName=../
• realName=..%2f
• realName=%2e%2e%2f
• realName=..%5c
• realName=%2e%2e%5c
• realName=../../
• realName=..\..\
• realName=/etc/passwd
• realName=/etc/shadow
• realName=C:\Windows\win.ini
• realName=C:\Windows\System32\drivers\etc\hosts
• ../etc/passwd
• ..%2f..%2f
• %2e%2e%2f%2e%2e%2f
• ..%5c..%5c

What your security team should do

• Prioritize inventory of NETGEAR ProSAFE Network Management System deployments and identify any instance running version 1.6.0.26.
• Upgrade to a vendor-fixed, supported release; if none is available for the deployed branch, plan replacement or retirement.
• Immediately restrict network access to the management interface to trusted administrators and management networks only.
• Add WAF, reverse proxy, or application-layer detection for traversal payloads in the realName parameter.
• Review logs for historical exploitation attempts, especially requests referencing ConfigFileController and traversal patterns.
• Audit the management server for missing or recently deleted application, configuration, credential, and log files.
• Rotate credentials or secrets stored on or accessible from the NMS server if suspicious file disclosure is detected.
• Ensure the NMS service account has least-privilege filesystem permissions and cannot access unnecessary sensitive paths.