PT-2025-33029 · Hyland · Hyland Onbase

Victor Morales · Published 1999-01-01 · Updated 2026-02-13 · CVE-2025-34153

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: Hyland OnBase versions prior to 17.0.2.87

Description: Hyland OnBase is vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the URI endpoint TimerServer, implemented in Hyland.Core.Timers.dll. This endpoint deserializes untrusted input using the .NET BinaryFormatter, allowing attackers to execute arbitrary code under the context of NT AUTHORITYSYSTEM.

Recommendations: Update Hyland OnBase to version 17.0.2.87 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-34153

DOTNETREMOTINGCHECK

Affected Products

Hyland Onbase

References · 11

• 🔥 https://gist.github.com/VAMorales/32794cccc2195a935623a12ef32760dc · Exploit
• https://community.hyland.com/resources/bulletins-and-notices/210540-security-update-hyland-timer-service-bulletin-ob2025-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34153 · Security Note
• https://support.hyland.com/r/OnBase/WorkView/Foundation-24.1/WorkView/Installation/Upgrade-Considerations/Upgrading-to-OnBase-Version-Foundation-24.1 · Patch
• https://hyland.com/en/internal/onbase-unity-client · Note
• https://t.me/cveNotify/151966 · Telegram Post
• https://vulncheck.com/advisories/hyland-onbase-net-remoting-tcp-channel-unauthenticated-rce · Note
• https://twitter.com/CVEnew/status/1955683536268075194 · Twitter Post
• https://twitter.com/CveFindCom/status/1955678217269882888 · Twitter Post
• https://t.me/cveNotify/132108 · Telegram Post
• https://twitter.com/offseq/status/1955849574238552234 · Twitter Post