{"id":"CVE-2025-3424","state":"PUBLISHED","title":"3.2.1 Arbitrary File Read in insecure .NET Remoting TCP Channel","description":"The IntelliSpace portal application utilizes .NET\nRemoting for its functionality. The vulnerability arises from the exploitation\nof port 755 through the \"Object Marshalling\" technique, which allows\nan attacker to read internal files without any authentication. This is possible\nby crafting specific .NET Remoting URLs derived from information enumerated in\nthe client-side configuration files.\n\n\n\n\n\n\n\nThis issue affects IntelliSpace Portal: 12 and prior.","publishedAt":"2025-04-07T15:36:46.060Z","updatedAt":"2025-04-10T15:42:10.381Z","severity":{"score":7.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Green","source":"Philips"},"assigner":"Philips","products":["Philips IntelliSpace Portal"],"affected":[{"vendor":"Philips","product":"IntelliSpace Portal","defaultStatus":"unaffected","versions":[{"version":"12 and prior","status":"affected"}],"modules":["filesystem"],"platforms":["Windows"]}],"references":["https://www.cve.org/CVERecord?id=CVE-2025-3424","https://www.philips.com/a-w/security/security-advisories.html#security_advisories"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/3xxx/CVE-2025-3424.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-3424","state":"PUBLISHED","datePublished":"2025-04-07T15:36:46.060Z","dateUpdated":"2025-04-10T15:42:10.381Z","assignerShortName":"Philips","assignerOrgId":"20705f08-db8b-4497-8f94-7eea62317651","dateReserved":"2025-04-07T15:05:10.307Z"},"containers":{"cna":{"title":"3.2.1 Arbitrary File Read in insecure .NET Remoting TCP Channel","descriptions":[{"lang":"en","value":"The IntelliSpace portal application utilizes .NET\nRemoting for its functionality. The vulnerability arises from the exploitation\nof port 755 through the \"Object Marshalling\" technique, which allows\nan attacker to read internal files without any authentication. This is possible\nby crafting specific .NET Remoting URLs derived from information enumerated in\nthe client-side configuration files.\n\n\n\n\n\n\n\nThis issue affects IntelliSpace Portal: 12 and prior."}],"affected":[{"vendor":"Philips","product":"IntelliSpace Portal","defaultStatus":"unaffected","versions":[{"version":"12 and prior","status":"affected"}],"modules":["filesystem"],"platforms":["Windows"]}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2025-3424"},{"url":"https://www.philips.com/a-w/security/security-advisories.html#security_advisories"}],"metrics":[{"cvssV4_0":{"Automatable":"YES","Recovery":"USER","Safety":"PRESENT","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":7.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Green","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Philips","orgId":"20705f08-db8b-4497-8f94-7eea62317651","dateUpdated":"2025-04-10T15:42:10.381Z"},"credits":[{"lang":"en","type":"finder","value":"Victor A Morales"},{"lang":"en","type":"finder","value":"Omar A Crespo"}],"datePublic":"2025-04-07T15:05:00.000Z","impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-07T16:11:37.059479Z","id":"CVE-2025-3424","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-07T16:11:44.627Z"}}]}}}