Critical

NetSarang Xmanager/Xshell/Xftp/Xlpd Supply-Chain Backdoor

IdentifiersCVE-2017-20203CWE-506· Embedded Malicious Code

CVE-2017-20203 is a supply-chain compromise affecting NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and Xlpd 5.0 Build 1220. The affected builds contained a malicious nssock2.dll rather than a benign vulnerable implementation. This DLL implemented a multi-stage DNS-based backdoor that remained dormant until it queried an attacker-controlled command-and-control domain using specially crafted DNS TXT records derived from the current month. After obtaining a decryption key from the C2 infrastructure, the malware downloaded and executed arbitrary code and created an encrypted virtual file system in the Windows registry to support follow-on activity and persistence. The issue is best characterized as embedded malicious code in a trojanized software distribution rather than a conventional memory-safety or input-validation flaw.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation gives the attacker full remote code execution on systems running the trojanized NetSarang builds. The backdoor also enables data exfiltration, persistent foothold establishment through an encrypted registry-resident virtual file system, and delivery/execution of additional payloads. Because the malicious DLL is embedded in trusted administrative software, compromise can provide durable access to enterprise environments where these tools are used for remote administration and file transfer. Exploitation was observed in the wild.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, isolate or remove affected NetSarang 5.0 builds from service, block known or suspected DNS-based C2 resolution paths, and monitor for anomalous TXT-record DNS queries from hosts running these products. Inspect for the presence of the malicious nssock2.dll and for encrypted VFS-like data stored in the registry. Restrict outbound DNS where feasible, apply application allowlisting, and treat any host with an affected build as potentially compromised until validated through forensic review.

Remediation

Patch, then assume compromise.

Upgrade to NetSarang’s remediated builds: Xmanager Enterprise Build 1236, Xmanager Build 1049, Xshell Build 1326, Xftp Build 1222, and Xlpd Build 1224. Replace any affected installations, remove the malicious nssock2.dll, and perform incident response on systems where the trojanized builds were installed, including review of registry persistence artifacts, DNS-based C2 activity, and any secondary payloads that may have been deployed. Given the supply-chain nature of the compromise, integrity verification of installation media and software provenance should be part of remediation.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

NetsarangXftpapplication

NetsarangXlpdapplication

NetsarangXmanagerapplication

NetsarangXshellapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

cvefeed high severityNews

Oct 9, 2025

CVE-2017-20203 - NetSarang v5.0 Malicious Backdoor Supply Chain Compromise

A critical supply chain compromise in NetSarang v5.0 products where a malicious DLL (nssock2.dll) was embedded, providing attackers with a multi-stage, DNS-based backdoor for remote code execution, data exfiltration, and persistence.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4