Netsarang develops a focused suite of terminal-emulation and remote-access utilities—including Xshell, Xftp, Xmanager, and related tools—that are widely deployed in enterprise network administration and system management environments. The vendor's vulnerability profile is characterized by memory-safety and privilege-escalation weaknesses, including buffer overflows, unquoted search paths, and information disclosure flaws, combined with an elevated tendency for public exploit code availability. Current exploitation activity, severity distribution, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Netsarang over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-48795MEDIUM The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet | Dec 18, 2023 | 5.9 | 81 | NO | YES |
CVE-2019-17320CRITICAL NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary checks when copying file name from an attacker controlled FTP | Oct 10, 2019 | 9.8 | 31 | NO | NO |
CVE-2022-33035HIGH XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. | Jun 29, 2022 | 7.8 | 25 | NO | NO |
CVE-2012-1009MEDIUM NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash) via a malformed LPD request. | Feb 14, 2012 | 5.0 | 25 | NO | YES |
CVE-2021-42095HIGH Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar. | Oct 7, 2021 | 7.5 | 24 | NO | NO |
CVE-2022-27966MEDIUM Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. | Mar 31, 2022 | 6.5 | 22 | NO | NO |
CVE-2022-27965MEDIUM Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. | Mar 31, 2022 | 6.5 | 22 | NO | NO |
CVE-2022-27964MEDIUM Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. | Mar 31, 2022 | 6.5 | 22 | NO | NO |
CVE-2022-27963MEDIUM Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. | Mar 31, 2022 | 6.5 | 22 | NO | NO |
CVE-2021-37326MEDIUM NetSarang Xshell 7 before Build 0077 includes unintended code strings in paste operations. | Aug 15, 2021 | 5.3 | 20 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Netsarang.
Media articles that mention a CVE ID that affects a product developed by Netsarang — matched by CVE ID, not by vendor name.