What vulnerabilities did MICROSENS patch in NMP Web+?

MICROSENS patched multiple security vulnerabilities in its NMP Web+ network management platform: CVE-2025-49151 (CVSS 9.3) for hard-coded security constants, CVE-2025-49153 (CVSS 9.3) for path traversal, and CVE-2025-49152 (CVSS 8.7) for insufficient session expiration. Successful exploitation could allow attackers to gain system access, overwrite files, or execute arbitrary code.

What is MICROSENS NMP Web+?

MICROSENS NMP Web+ is a network management platform used for managing and monitoring network infrastructure. It provides centralized control and management capabilities for network devices and systems across enterprise environments.

What is CVE-2025-49151?

CVE-2025-49151 (CVSS score 9.3) is a vulnerability involving the use of hard-coded, security-relevant constants that allows unauthenticated attackers to generate forged JSON Web Tokens (JWT) to bypass authentication mechanisms entirely. The flaw is caused by hard-coded security constants that can be exploited to create valid authentication tokens without legitimate credentials.

What is CVE-2025-49153?

CVE-2025-49153 (CVSS score 9.3) is an improper limitation of a pathname to a restricted directory vulnerability - a path traversal flaw that allows unauthenticated attackers to overwrite files and execute arbitrary code on affected systems by manipulating file paths to access restricted directories and system resources.

What is CVE-2025-49152?

CVE-2025-49152 (CVSS score 8.7) is an insufficient session expiration vulnerability where JSON Web Tokens do not expire, allowing attackers who obtain access to a token through interception, leakage, or compromise to maintain persistent access to systems indefinitely without time limitations.

How can these vulnerabilities be chained together?

These vulnerabilities can be combined for maximum impact: CVE-2025-49151 enables initial access through authentication bypass, CVE-2025-49152 provides persistence through non-expiring tokens, and CVE-2025-49153 allows escalation to arbitrary code execution through path traversal attacks.

Do these vulnerabilities require authentication to exploit?

No, both CVE-2025-49151 and CVE-2025-49153 can be exploited by unauthenticated attackers. This makes them particularly dangerous as attackers don't need valid credentials to potentially bypass authentication or execute arbitrary code on the system.

Why are non-expiring JWT tokens dangerous?

Non-expiring JWT tokens are dangerous because once an attacker obtains a token through any means (interception, leakage, or system compromise), they can maintain persistent access indefinitely. This effectively bypasses credential revocation, password changes, and normal session management controls that would otherwise limit unauthorized access.

Why are these MICROSENS vulnerabilities particularly concerning for network management?

These vulnerabilities are particularly concerning because NMP Web+ is used for network management and monitoring, making it a high-value target. Successful exploitation could allow attackers to compromise network infrastructure management, potentially affecting entire network segments, accessing sensitive network configurations, and using the management platform as a launching point for lateral movement within the organization's infrastructure. The combination of authentication bypass, persistent access, and code execution capabilities makes this a critical threat to network security.

Advisory

Multiple critical flaws reported in MICROSENS NMP Web+ Network Management Platform

published: June 24, 2025

Take action: If you use MICROSENS NMP Web+ network management platform, make sure it's isolated from the internet and accessible only fron trusted networks. Then plan a quick update to version 3.3.0 to patch, because these flaws are fairly trivial to abuse.

Learn More

MICROSENS has patched multiple security vulnerabilities in its NMP Web+ network management platform. Successful exploitation could allow attackers to gain system access, overwrite files, or execute arbitrary code on affected systems.

Vulnerabilities summary

CVE-2025-49151 (CVSS score 9.3) - Use of Hard-coded, Security-relevant Constants - allows unauthenticated attackers to generate forged JSON Web Tokens (JWT) to bypass authentication mechanisms entirely. The flaw is caused by the use of hard-coded security constants that can be exploited to create valid authentication tokens without legitimate credentials.
CVE-2025-49153 (CVSS score 9.3) - Improper Limitation of a Pathname to a Restricted Directory - a path traversal vulnerability that allows unauthenticated attackers to overwrite files and execute arbitrary code on affected systems by manipulating file paths to access restricted directories and system resources.
CVE-2025-49152 (CVSS score 8.7) - Insufficient Session Expiration - JSON Web Tokens do not expire, allowing attackers who obtain access to a token through interception, leakage, or compromise to maintain persistent access to systems indefinitely. Once issued, these tokens remain valid without time limitations, effectively bypassing credential revocation or session management controls.

Combining these flaws enables access (CVE-2025-49151) and persistence (CVE-2025-49153), then escalating and arbitrary code execution (CVE-2025-49152).

The vulnerabilities affect all versions of MICROSENS NMP Web+ Version 3.2.5 and prior installations across Windows and Linux platforms.

MICROSENS recommends that all users immediately update to NMP Web+ Version 3.3.0 for both Windows and Linux platforms. The updated version addresses all three identified vulnerabilities.

Organizations should minimize network exposure for all control system devices and ensure they are not accessible from the internet.

Multiple critical flaws reported in MICROSENS NMP Web+ Network Management Platform

Read More
Rockwell Automation reports another critical issue in FactoryTalk …
Critical authentication bypass in Güralp Systems seismic monitoring …
CISA reportd active exploitation of Meteobridge command injection …
Dahua smart camera flaws enable remote device takeover
Siemens fixes critical issue in Sintesoand Cerberus Fire …