Design/Logic Flaw

2023-07-1002:15:00

PRIOn knowledge base

www.prio-n.com

smartbpm.net

vulnerability

hard-coded machine key

remote code execution

arbitrary code

disrupt service

nvd

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.4%

JSON

SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.

CPENameOperatorVersion
smartbpm.neteq6.70

CPE	Name	Operator	Version
	smartbpm.net	eq	6.70

References

www.twcert.org.tw/tw/cp-132-7221-438c6-1.html