CVE-2021-26914

EPSS 77.7%

Vexday Risk Score

40Atenção

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 77.7%KEV nãoPoC —Nuclei —Metasploit simPatch —

Ciclo de vida

08 fev 2021Exploit Metasploit disponível

08 fev 2021Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.

Produtos afetados

n/a · n/a

Referências

http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.html https://ssd-disclosure.com/?p=4676 https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020