NetSarang Computer Xmanager Enterprise/Xmanager/Xshell/Xftp/Xlpd 5.0 nssock2.dll malicious code

Summaryinfo

A vulnerability classified as very critical has been found in NetSarang Computer Xmanager Enterprise, Xmanager, Xshell, Xftp and Xlpd 5.0. The impacted element is an unknown function in the library nssock2.dll. Performing a manipulation results in malicious code. This vulnerability was named CVE-2025-34252. The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in NetSarang Computer Xmanager Enterprise, Xmanager, Xshell, Xftp and Xlpd 5.0. It has been classified as very critical. This affects some unknown processing in the library nssock2.dll. The manipulation with an unknown input leads to a malicious code vulnerability. CWE is classifying the issue as CWE-506. The product contains code that appears to be malicious in nature. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220 contain a malicious nssock2.dll that implements a multi-stage, DNS-based backdoor. The dormant library contacts a C2 DNS server via a specially crafted TXT record for a month‑generated domain. After receiving a decryption key, it then downloads and executes arbitrary code, creates an encrypted virtual file system (VFS) in the registry, and grants the attacker full remote code execution, data exfiltration, and persistence. NetSarang released builds for each product line that remediated the compromise: Xmanager Enterprise Build 1236, Xmanager Build 1049, Xshell Build 1326, Xftp Build 1222, and Xlpd Build 1224. Kaspersky Lab identified an instance of exploitation in the wild in August 2017.

The weakness was presented by Kaspersky Lab. It is possible to read the advisory at web.archive.org. This vulnerability is uniquely identified as CVE-2025-34252 since 04/15/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/09/2025).

The exploit is shared for download at web.archive.org. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-32881). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• NetSarang Computer

Name

• Xftp
• Xlpd
• Xmanager
• Xmanager Enterprise
• Xshell

Version

• 5.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion