NetSupport Manager versions before 14.12.0001 use a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. This key is stored in a reversible encoded form within client configuration files. If an attacker obtains such a configuration file, they can decode the Gateway Key to plaintext. With the recovered key, the attacker can access NetSupport Manager connectivity services without authorization and remotely control systems managed under the same key. This vulnerability is classified under CWE-257 for storing passwords in a recoverable format. The CVSS 4.0 score is 8.4, indicating high severity with local attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker who gains local access to a deployed client configuration file can recover the plaintext Gateway Key, enabling unauthorized access to NetSupport Manager connectivity services. This allows the attacker to remotely control systems managed with the compromised key, potentially leading to full system compromise within the scope of the affected environment. The vulnerability affects confidentiality, integrity, and availability of the managed systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to client configuration files to trusted users only and monitor for unauthorized local access. Consider changing Gateway Keys if possible and applying network-level controls to limit exposure of NetSupport Manager connectivity services.