CVE-2021-26914

40Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 78%

de la publicación al arma0 días

Publicada en NVD8 feb

metasploit8 feb

probabilidad de explotación

78%top 1% de las CVE

explotación observada

noninguna fuente lo reporta

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.

Productos afectados

n/a · n/a

Referencias

http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.html https://ssd-disclosure.com/?p=4676 https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020