PT-2025-15255 · Philips · Intellispace Portal

Published 2025-04-07 · Updated 2025-04-09 · CVE-2025-3424

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Green

Name of the Vulnerable Software and Affected Versions IntelliSpace Portal versions 12 and prior

Description The issue arises from the exploitation of port 755 through the "Object Marshalling" technique, allowing an attacker to read internal files without authentication. This is possible by crafting specific .NET Remoting URLs derived from information enumerated in the client-side configuration files.

Recommendations For IntelliSpace Portal versions 12 and prior, consider restricting access to port 755 as a temporary workaround until a patch is available. Additionally, review and secure client-side configuration files to prevent information enumeration.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-3424

Affected Products

Intellispace Portal

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-3424 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-3424 · Security Note
• https://twitter.com/cybercronai/status/1909316614438215968 · Twitter Post
• https://twitter.com/cybercronai/status/1909758678976102578 · Twitter Post
• https://philips.com/a-w/security/security-advisories.html#security_advisories · Note
• https://twitter.com/CVEnew/status/1909272592919179593 · Twitter Post
• https://t.me/cvedetector/22316 · Telegram Post
• https://t.me/cvetracker/21018 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1909392294119162300 · Twitter Post