Metasploit Wrap-Up

Dell DBUtil23.sys IOCTL memmove privilege escalation Our very own zeroSteiner added a new module, which exploits insufficient access control in Dell's dbutil23.sys firmware update driver included in the Dell Bios Utility that comes pre-installed with most Windows machines. The driver accepts...

NetMotion Mobility Server MvcUtil Java Deserialization

This module exploits an unauthenticated Java deserialization in the NetMotion Mobility server's MvcUtil.valueStringToObject method, as invoked through the /mobility/Menu/isLoggedOn endpoint, to execute code as the SYSTEM account. Mobility server versions 11.x before 11.73 and 12.x before 12.02 ar...

CVE-2021-26914

creationtimestamp| type| source ---|---|--- 2021-02-09 00:39:22+00:00| seen| https://t.me/cibsecurity/23274 2021-05-17 19:53:59+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/netmotionmobilitymvcutildeserialization.rb 2024-01-07 05:08:20+00:0...

CVE-2021-26914

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject...

CVE-2021-26914

NetMotion Mobility vulnerable to unauthenticated remote code execution via Java deserialization in MvcUtil.valueStringToObject. Affected products: NetMotion Mobility Server (11.x before 11.73 and 12.x before 12.02). Exploitation path is via the server’s Java deserialization in the MvcUtil class, ...