PT-2025-39674 · Microsoft+1 · .Net Remoting+1

Published 1999-01-01 · Updated 2025-09-30 · CVE-2025-58384

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DOXENSE WATCHDOC versions prior to 6.1.1.5332

Description The software contains a flaw related to the deserialization of untrusted data. This issue, present in the .NET Remoting library within the Watchdoc administration interface, can allow for remote code execution. Approximately 157 instances are reportedly exposed. An attacker can invoke an unauthenticated API endpoint to execute arbitrary code remotely, potentially compromising the system. The vulnerability affects all printers in the network.

Recommendations Versions prior to 6.1.1.5332 should be upgraded. Restrict access to port 5744.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-12416

CVE-2025-58384

DOTNETREMOTINGCHECK

Affected Products

.Net Remoting

Doxense Watchdoc

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-58384 · Security Note
• https://bdu.fstec.ru/vul/2025-12416 · Security Note
• https://t.me/pentestingnews/68901 · Telegram Post
• https://twitter.com/autumn_good_35/status/1972698336160522583 · Twitter Post
• https://twitter.com/zoomeye_team/status/1972861990776209676 · Twitter Post
• https://doc.doxense.com/Watchdoc/J_Securite/cve-2025-58384.htm · Note
• https://update.doxense.com · Note
• https://twitter.com/CCBalert/status/1972667007699992741 · Twitter Post
• https://twitter.com/offseq/status/1971772288237277250 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971668305032167579 · Twitter Post
• https://t.me/CVEtracker/33493 · Telegram Post
• https://twitter.com/SecAideInfo/status/1972606304481951929 · Twitter Post
• https://twitter.com/CVEnew/status/1971647490773381351 · Twitter Post
• https://twitter.com/PurpleOps_io/status/1972889293560348847 · Twitter Post