CVE-2025-3425

Unauthenticated Remote Code Execution via .NET Deserialization

CVSS 7.3 HIGHEPSS 0.3%CWE-502

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

07 Apr 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed that the server had set the TypeFilterLevel to Full which is dangerous as it can potentially lead to remote code execution using deserialization. This issue affects IntelliSpace Portal: 12 and prior.

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Green

Affected products

Philips · IntelliSpace Portal

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.cve.org/CVERecord?id=CVE-2025-3425 https://www.philips.com/a-w/security/security-advisories.html#security_advisories