NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in RpcServlet.
References
| Link | Resource |
|---|---|
| https://ssd-disclosure.com/?p=4676 | Exploit Third Party Advisory |
| https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/ | Exploit Third Party Advisory |
| https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
23 Feb 2021, 16:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 9.3
v3 : 8.1 |
11 Feb 2021, 14:49
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:netmotionsoftware:netmotion_mobility:*:*:*:*:*:*:*:* | |
| CWE | CWE-502 | |
| References | (MISC) https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 - Vendor Advisory | |
| References | (MISC) https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/ - Exploit, Third Party Advisory | |
| References | (MISC) https://ssd-disclosure.com/?p=4676 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 10.0
v3 : 9.8 |
08 Feb 2021, 22:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-02-08 22:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-26913
Mitre link : CVE-2021-26913
CVE.ORG link : CVE-2021-26913
JSON object : View
Products Affected
netmotionsoftware
- netmotion_mobility
CWE
CWE-502
Deserialization of Untrusted Data