CVE-2025-35050

Katalog CVE

CVSS 9.8 · Critical EPSS 0,92%

Kerentanan Missing Authentication for Critical Function pada newforma project center. Skor CVSS 3.1 9.8 (Critical) menurut CNA.

Deskripsi (NVD)

Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module.

Rincian

Terbit di NVD

9 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cve.org/CVERecord?id=CVE-2025-35050 advisory pihak ketiga · pemerintah AS
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json advisory pihak ketiga
• https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-the-url-rewrite-module product
• https://projectcenter.help.newforma.com/overviews/info_exchange_overview/ product