CWE Code: 502
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Deserialization of Untrusted Data
Summary: mirasys vms before v7.6.1 and 8.x before v8.3.2 mishandles the mirasys.common.utils.security.datacrypt method in common.dll in audittrailservice in smserver.exe. this method triggers insecure deserialization within the .net garbage collector, in which a gadget (contained in a serialized object) may be executed with system privileges. the attacker must properly encrypt the object; however, the hardcoded keys are available.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-08-22
Last Modified Date: 2019-08-30