PT-2021-17170 · Netmotion · Netmotion Mobility

Steven Seeley · Published 2021-02-08 · Updated 2021-02-23 · CVE-2021-26913

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NetMotion Mobility versions prior to 11.73 NetMotion Mobility versions 12.x prior to 12.02

Description: The issue allows unauthenticated remote attackers to execute arbitrary code as SYSTEM due to Java deserialization in RpcServlet.

Recommendations: For versions prior to 11.73, update to version 11.73 or later. For versions 12.x prior to 12.02, update to version 12.02 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-26913

Affected Products

Netmotion Mobility

References · 6

• 🔥 https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce · Exploit
• 🔥 https://ssd-disclosure.com/?p=4676 · Exploit
• https://osv.dev/vulnerability/CVE-2021-26913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26913 · Security Note
• https://netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 · Vendor Advisory
• https://t.me/cibsecurity/23281 · Telegram Post