CVE-2025-35050
CRITICALNewforma Project Center - Insecure Deserialization
Title source: ruleDescription
Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module.
References (4)
Scores
CVSS v3
9.8
EPSS
0.0032
EPSS Percentile
54.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
CWE-306
Status
published
Affected Products (1)
newforma/project_center
Timeline
Published
Oct 09, 2025
Tracked Since
Feb 18, 2026