A vulnerability identified as CWE-502: Deserialization of Untrusted Data exists, which could lead to remote code execution and compromise system integrity. This issue arises when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization. The severity of this vulnerability is classified as high, necessitating immediate attention.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-54923 |
Exploitation
To exploit this vulnerability, an attacker must be able to send crafted data to a vulnerable network-exposed service. Given the low attack complexity and the requirement for low privileges, an authenticated user could potentially trigger the unsafe deserialization process, leading to remote code execution.
Affected Products
- Network-exposed services that perform unsafe deserialization.
Mitigation
To mitigate this vulnerability, it is essential to implement secure coding practices that prevent unsafe deserialization. Additionally, restricting access to network-exposed services and ensuring that only trusted data is processed can help reduce the risk of exploitation.