CVE-2025-66631CWE-502insecure-deserialization

CVE-2025-66631

Critical · published December 9, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00674 · 51.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-12-09T21:18Z
Affected products (1)
ProductVersionsFixed in
cslanet/csla_.net< 6.0.06.0.0
References (3)
https://github.com/MarimerLLC/csla/issues/4001 · [email protected]https://github.com/MarimerLLC/csla/pull/4018 · [email protected]https://github.com/MarimerLLC/csla/security/advisories/GHSA-wq34-7f4g-953v · [email protected]
EPSS history
Timeline
  • 09 DEC 03:18Z
    CSLA .NET is vulnerable to Remote Code Execution via WcfProxy
    cvelistv5