CVE-2025-35051

Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://projectcenter.help.newforma.com/overviews/info_exchange_overview/	Product
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-35051	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:newforma:project_center:2024.3:*:*:*:*:*:*:*

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Newforma Project Center Server (NPCS) acepta datos .NET serializados a través del endpoint '/ProjectCenter.rem' en 9003/tcp, permitiendo a un atacante remoto no autenticado ejecutar código arbitrario con privilegios de 'NT AUTHORITY\NetworkService'. Según la arquitectura recomendada, el endpoint NPCS vulnerable solo es accesible en una red interna. Para mitigar esta vulnerabilidad, restrinja el acceso de red a NPCS.

Information

Published : 2025-10-09 21:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-35051

Mitre link : CVE-2025-35051

CVE.ORG link : CVE-2025-35051

JSON object : View

Products Affected

newforma

project_center

CWE

CWE-306

Missing Authentication for Critical Function

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2025-35051", "cveTags": [], "metrics": {"ssvcV203": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "ssvcData": {"id": "CVE-2025-35051", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-08-15T18:11:09.018573Z"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-35051", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-10T19:37:16.907081Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "affectedData": [{"vendor": "Newforma", "product": "Project Center", "versions": [{"status": "affected", "version": "*"}, {"status": "affected", "version": "2024.3"}], "defaultStatus": "unknown"}]}], "published": "2025-10-09T21:15:35.873", "references": [{"url": "https://projectcenter.help.newforma.com/overviews/info_exchange_overview/", "tags": ["Product"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json", "tags": ["Third Party Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-35051", "tags": ["Third Party Advisory", "US Government Resource"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS."}, {"lang": "es", "value": "Newforma Project Center Server (NPCS) acepta datos .NET serializados a trav\u00e9s del endpoint '/ProjectCenter.rem' en 9003/tcp, permitiendo a un atacante remoto no autenticado ejecutar c\u00f3digo arbitrario con privilegios de 'NT AUTHORITY\\NetworkService'. Seg\u00fan la arquitectura recomendada, el endpoint NPCS vulnerable solo es accesible en una red interna. Para mitigar esta vulnerabilidad, restrinja el acceso de red a NPCS."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:newforma:project_center:2024.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F878C37-A9AB-4887-9F8E-BC2129CEF077"}], "operator": "OR"}]}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"}