NetMotion Mobility up to 11.72/12.01 Java deserialization

Summaryinfo

A vulnerability categorized as critical has been discovered in NetMotion Mobility up to 11.72/12.01. This vulnerability affects unknown code of the component Java Handler. Such manipulation leads to deserialization. This vulnerability is documented as CVE-2021-26913. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in NetMotion Mobility up to 11.72/12.01. Affected by this issue is an unknown functionality of the component Java Handler. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability.

The weakness was released 02/09/2021. The advisory is shared for download at ssd-disclosure.com. This vulnerability is handled as CVE-2021-26913. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/25/2021).

Upgrading to version 11.73 or 12.02 eliminates this vulnerability. The upgrade is hosted for download at netmotionsoftware.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• NetMotion

Name

• Mobility

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16
• 11.17
• 11.18
• 11.19
• 11.20
• 11.21
• 11.22
• 11.23
• 11.24
• 11.25
• 11.26
• 11.27
• 11.28
• 11.29
• 11.30
• 11.31
• 11.32
• 11.33
• 11.34
• 11.35
• 11.36
• 11.37
• 11.38
• 11.39
• 11.40
• 11.41
• 11.42
• 11.43
• 11.44
• 11.45
• 11.46
• 11.47
• 11.48
• 11.49
• 11.50
• 11.51
• 11.52
• 11.53
• 11.54
• 11.55
• 11.56
• 11.57
• 11.58
• 11.59
• 11.60
• 11.61
• 11.62
• 11.63
• 11.64
• 11.65
• 11.66
• 11.67
• 11.68
• 11.69
• 11.70
• 11.71
• 11.72
• 12.01

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion