A service console interface on openPDC and openHistorian deserializes a client-supplied data structure
Why It Matters
Analysis dossierWhy It Matters
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.
High Severity / Review
Unknown
Unknown
Risk basis: Microsoft or Microsoft-managed product relevance; CRITICAL severity; Critical CVSS without confirmed KEV exploitation
Affected Products & Remediation
0 source-backed productsVendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched deserialization (CWE-502); network-unauthenticated (CVSS AV:N, CVSS PR:N, CVSS UI:N)
Exposure
- Find installations of the affected component and confirm the source-stated version range.Telemetry: Application inventory · Deserialization risk requires component and version evidence. · Rule deserialization
- Identify devices reporting this CVE and note which expose the affected service to untrusted networks.Telemetry: DeviceTvmSoftwareVulnerabilities · A network-reachable, no-privilege vector makes internet-facing instances the first exposure question. · Rule network-unauthenticated
Exploitation evidence
- Review unusual child processes or network connections from the affected service.Telemetry: DeviceProcessEvents · Unexpected behavior may support investigation but is not proof by itself. · Rule deserialization
Show more (2)
Exploitation evidence
- Review inbound connections to the affected service from unexpected sources since the advisory date.Telemetry: DeviceNetworkEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule network-unauthenticated
Response
- Verify the vendor update or mitigation on each affected installation.Telemetry: Application change records · Response must follow the authoritative source guidance. · Rule deserialization
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- ics-cert@hq.dhs.gov
- Record status · verification
- UPDATED · NVD API
- CPE
- Unknown
Evidence & Provenance
— No published hunting query names this record. Browse community and library queries instead.
Correlated briefings
— No published briefing references this CVE