CVE-2025-27816
Published: 07 March 2025
Description
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Security Summary
CVE-2025-27816 is a vulnerability discovered in Arctera InfoScale versions 7.0 through 8.0.2, affecting the Windows Plugin_Host service that runs on all servers where InfoScale is installed. The flaw arises from insecure deserialization of potentially untrusted messages in a .NET remoting endpoint. This service is used only when applications are configured for Disaster Recovery (DR) using the DR wizard.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Exploitation of the deserialization issue in the Plugin_Host service can result in high impacts to confidentiality, integrity, and availability.
The Veritas security advisory (ARC25-002) at https://www.veritas.com/content/support/en_US/security/ARC25-002 notes that manually disabling the Plugin_Host service eliminates the vulnerability.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Insecure deserialization in the .NET remoting endpoint of the Plugin_Host service directly enables unauthenticated remote exploitation of the service for code execution.