CVE-2025-35051

Katalog CVE

CVSS 9.8 · Critical EPSS 0,84%

Kerentanan Missing Authentication for Critical Function pada newforma project center. Skor CVSS 3.1 9.8 (Critical) menurut CNA.

Deskripsi (NVD)

Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS.

Rincian

Terbit di NVD

9 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,84% peluang dieksploitasi; lebih tinggi dari 56,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cve.org/CVERecord?id=CVE-2025-35051 advisory pihak ketiga · pemerintah AS
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json advisory pihak ketiga
• https://projectcenter.help.newforma.com/overviews/info_exchange_overview/ product