PT-2021-17172 · Netmotion · Netmotion Mobility

Steven Seeley · Published 2021-02-08 · Updated 2021-02-24 · CVE-2021-26915

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NetMotion Mobility versions prior to 11.73 NetMotion Mobility versions 12.x prior to 12.02

Description: The issue allows unauthenticated remote attackers to execute arbitrary code as SYSTEM due to Java deserialization in the webrepdb StatusServlet.

Recommendations: For versions prior to 11.73, update to version 11.73 or later. For versions 12.x prior to 12.02, update to version 12.02 or later. As a temporary workaround, consider disabling the StatusServlet until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-26915

Affected Products

Netmotion Mobility

References · 6

• 🔥 https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce · Exploit
• 🔥 https://ssd-disclosure.com/?p=4676 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-26915 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26915 · Vendor Advisory
• https://netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020 · Vendor Advisory
• https://t.me/cibsecurity/23275 · Telegram Post