CVE-2025-66631
Published: 09 December 2025
Description
CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization.…
more
This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation addresses the deserialization vulnerability by patching CSLA .NET to version 6.0.0 or implementing the WcfProxy removal workaround.
Least functionality restricts or prohibits the obsolete WcfProxy component, eliminating the vulnerable NetDataContractSerializer deserialization path.
Information input validation checks serialized data before deserialization, mitigating exploitation of untrusted inputs targeting NetDataContractSerializer.
Security SummaryAI
CVE-2025-66631 is a remote code execution vulnerability in the CSLA .NET framework, which is designed for developing reusable, object-oriented business layers in applications. The issue affects versions 5.5.4 and below, specifically in the WcfProxy component. WcfProxy relies on the now-obsolete NetDataContractSerializer (NDCS) for deserialization, making it susceptible to exploitation during this process. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Any unauthenticated attacker with network access can exploit this vulnerability by sending maliciously crafted serialized data to a vulnerable CSLA .NET application using WcfProxy. The attack requires low complexity and no user interaction, allowing remote code execution on the target system. Successful exploitation enables attackers to achieve high impacts on confidentiality, integrity, and availability, potentially compromising the entire application server.
Mitigation is available in CSLA .NET version 6.0.0, which addresses the vulnerability. As a workaround, remove WcfProxy from data portal configurations. Additional details are provided in the GitHub security advisory (GHSA-wq34-7f4g-953v), issue tracker (#4001), and pull request (#4018).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote code execution via deserialization of untrusted data in a public-facing WCF service component (WcfProxy), directly mapping to exploitation of public-facing applications.