CVE-2021-26914

EPSS 77.7%

Vexday Risk Score

40Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 77.7%KEV nãoPoC —Nuclei —Metasploit simPatch —

Ciclo de vida

08 feb 2021Exploit Metasploit disponible

08 feb 2021Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.

Productos afectados

n/a · n/a

Referencias

http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.html https://ssd-disclosure.com/?p=4676 https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020