CVE-2025-35050

Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-the-url-rewrite-module	Product
https://projectcenter.help.newforma.com/overviews/info_exchange_overview/	Product
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-35050	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:newforma:project_center:2024.3:*:*:*:*:*:*:*

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Newforma Info Exchange (NIX) acepta datos .NET serializados a través del endpoint '/remoteweb/remote.rem', permitiendo a un atacante remoto no autenticado ejecutar código arbitrario con privilegios de 'NT AUTHORITY\NetworkService'. El endpoint vulnerable es utilizado por Newforma Project Center Server (NPCS), por lo que un sistema NIX comprometido puede ser utilizado para atacar un sistema NPCS asociado. Para mitigar esta vulnerabilidad, restrinja el acceso de red al endpoint '/remoteweb/remote.rem', por ejemplo, utilizando el Módulo de Reescritura de URL de IIS.

Information

Published : 2025-10-09 21:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-35050

Mitre link : CVE-2025-35050

CVE.ORG link : CVE-2025-35050

JSON object : View

Products Affected

newforma

project_center

CWE

CWE-306

Missing Authentication for Critical Function

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-35050", "cveTags": [], "metrics": {"ssvcV203": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "ssvcData": {"id": "CVE-2025-35050", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-08-19T16:47:38.357302Z"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-35050", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-10T19:38:00.739242Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "affectedData": [{"vendor": "Newforma", "product": "Project Center", "versions": [{"status": "affected", "version": "*"}, {"status": "affected", "version": "2024.3"}], "defaultStatus": "unknown"}]}], "published": "2025-10-09T21:15:35.707", "references": [{"url": "https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/using-the-url-rewrite-module", "tags": ["Product"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://projectcenter.help.newforma.com/overviews/info_exchange_overview/", "tags": ["Product"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json", "tags": ["Third Party Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-35050", "tags": ["Third Party Advisory", "US Government Resource"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module."}, {"lang": "es", "value": "Newforma Info Exchange (NIX) acepta datos .NET serializados a trav\u00e9s del endpoint '/remoteweb/remote.rem', permitiendo a un atacante remoto no autenticado ejecutar c\u00f3digo arbitrario con privilegios de 'NT AUTHORITY\\NetworkService'. El endpoint vulnerable es utilizado por Newforma Project Center Server (NPCS), por lo que un sistema NIX comprometido puede ser utilizado para atacar un sistema NPCS asociado. Para mitigar esta vulnerabilidad, restrinja el acceso de red al endpoint '/remoteweb/remote.rem', por ejemplo, utilizando el M\u00f3dulo de Reescritura de URL de IIS."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:newforma:project_center:2024.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F878C37-A9AB-4887-9F8E-BC2129CEF077"}], "operator": "OR"}]}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"}