NSClient++ 0.5.2.35 stores the administrative password in plaintext in nsclient.ini, which is world‑readable for local users. An attacker who can read the file can extract the password, authenticate to the NSClient++ web interface that normally runs on port 8443, and then exploit the ExternalScripts plugin by registering a custom script. Once the script is registered and the configuration saved, the attacker can trigger it via the API, causing arbitrary command execution as SYSTEM. This flaw is a classic example of vulnerable credential storage (CWE‑522) leading to unchecked privilege escalation and complete system compromise.

The vulnerability affects Windows systems running NSClient++ version 0.5.2.35. No other product versions are listed as affected. The issue arises when the web interface and ExternalScripts features are enabled in the configuration.

With a CVSS score of 7.3 the vulnerability is considered high severity, and an EPSS score of 7 % indicates a modest probability of exploitation. The flaw is reachable by any local user who can read files, so the attacker does not need network access. The exploit flow requires reading nsclient.ini, logging in via the web interface, and then abusing the ExternalScripts API to run commands as SYSTEM. Since the vulnerability is local and the information is well‑documented, it is likely to be employed by threat actors looking to gain elevated privileges on compromised Windows hosts.