NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in SupportRpcServlet.
References
Link | Resource |
---|---|
https://ssd-disclosure.com/?p=4676 | Exploit Third Party Advisory |
https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/ | Exploit Third Party Advisory |
https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
23 Feb 2021, 16:21
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 9.3
v3 : 8.1 |
11 Feb 2021, 14:49
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-502 | |
CPE | cpe:2.3:a:netmotionsoftware:netmotion_mobility:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : 10.0
v3 : 9.8 |
References | (MISC) https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 - Vendor Advisory | |
References | (MISC) https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/ - Exploit, Third Party Advisory | |
References | (MISC) https://ssd-disclosure.com/?p=4676 - Exploit, Third Party Advisory |
08 Feb 2021, 22:19
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-02-08 22:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-26912
Mitre link : CVE-2021-26912
CVE.ORG link : CVE-2021-26912
JSON object : View
Products Affected
netmotionsoftware
- netmotion_mobility
CWE
CWE-502
Deserialization of Untrusted Data