by Kastro
Paper/Archive/CVE-2025-35051

CVE-2025-35051

Newforma Project Center — Newforma Project Center Server (NPCS) .NET unauthenticated deserialization

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 57.8.578 × 2011.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS.

Affected

ProductAffectedFixed inSource
Project Centerall versions–CNA
Project Center2024.3–CNA

Scores by source

cisa-cg (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cisa-cg (CNA)7.7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/MAV:A
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refprojectcenter.help.newforma.com/overviews/info_exchange_overviewrefraw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.jsonrefcve.org/CVERecord?id=CVE-2025-35051