CVE-2025-35051highCWE-306CWE-502

CVE-2025-35051: fallo de gravedad alta en Newforma Project Center

Newforma Project Center Server (NPCS) .NET unauthenticated deserialization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Project Center

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.7epss 0.8%
Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/MAV:A
Productos afectados
Newforma · Project Center
CVEs relacionadas — Newforma Project Center

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-35050CRITICALNewforma Info Exchange (NIX) .NET unauthenticated deserializationEPSS 0.9%CVE-2025-35055HIGHNewforma Info Exchange (NIX) insecure file uploadEPSS 0.6%CVE-2025-35053MEDIUMNewforma Info Exchange (NIX) arbitrary file read and deleteEPSS 0.4%CVE-2025-35061HIGHNewforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmxEPSS 0.4%CVE-2025-35058HIGHNewforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashxEPSS 0.4%CVE-2025-35052MEDIUMNewforma Info Exchange (NIX) shared hard-coded secret keyEPSS 0.4%