CVE-2021-26914

HIGH

Netmotionsoftware Netmotion Mobility - Insecure Deserialization

Title source: rule

Description

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.

Exploits (1)

metasploit WORKING POC EXCELLENT

by mr_me, wvu · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/netmotion_mobility_mvcutil_deserialization.rb

View Code ZIP pw:eip

References (4)

[Exploit, Third Party Advisory] https://ssd-disclosure.com/?p=4676

[Vendor Advisory] https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020

[Exploit, Third Party Advisory] https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.html

Scores

CVSS v3 8.1

EPSS 0.6444

EPSS Percentile 98.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-502

Status published

Products (1)

netmotionsoftware/netmotion_mobility < 11.73

Published Feb 08, 2021

Tracked Since Feb 18, 2026