CVE-2025-3424 (GCVE-0-2025-3424)
Vulnerability from cvelistv5
Published
2025-04-07 15:36
Modified
2025-04-10 15:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
The IntelliSpace portal application utilizes .NET
Remoting for its functionality. The vulnerability arises from the exploitation
of port 755 through the "Object Marshalling" technique, which allows
an attacker to read internal files without any authentication. This is possible
by crafting specific .NET Remoting URLs derived from information enumerated in
the client-side configuration files.
This issue affects IntelliSpace Portal: 12 and prior.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Philips | IntelliSpace Portal |
Version: 12 and prior |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-07T16:11:37.059479Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-07T16:11:44.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"filesystem"
],
"platforms": [
"Windows"
],
"product": "IntelliSpace Portal",
"vendor": "Philips",
"versions": [
{
"status": "affected",
"version": "12 and prior"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Victor A Morales"
},
{
"lang": "en",
"type": "finder",
"value": "Omar A Crespo"
}
],
"datePublic": "2025-04-07T15:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe IntelliSpace portal application utilizes .NET\nRemoting for its functionality. The vulnerability arises from the exploitation\nof port 755 through the \"Object Marshalling\" technique, which allows\nan attacker to read internal files without any authentication. This is possible\nby crafting specific .NET Remoting URLs derived from information enumerated in\nthe client-side configuration files.\u003c/p\u003e\n\n\n\n\n\n\u003cp\u003eThis issue affects IntelliSpace Portal: 12 and prior.\u003c/p\u003e"
}
],
"value": "The IntelliSpace portal application utilizes .NET\nRemoting for its functionality. The vulnerability arises from the exploitation\nof port 755 through the \"Object Marshalling\" technique, which allows\nan attacker to read internal files without any authentication. This is possible\nby crafting specific .NET Remoting URLs derived from information enumerated in\nthe client-side configuration files.\n\n\n\n\n\n\n\nThis issue affects IntelliSpace Portal: 12 and prior."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "PRESENT",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-10T15:42:10.381Z",
"orgId": "20705f08-db8b-4497-8f94-7eea62317651",
"shortName": "Philips"
},
"references": [
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3424"
},
{
"url": "https://www.philips.com/a-w/security/security-advisories.html#security_advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "3.2.1 Arbitrary File Read in insecure .NET Remoting TCP Channel",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "20705f08-db8b-4497-8f94-7eea62317651",
"assignerShortName": "Philips",
"cveId": "CVE-2025-3424",
"datePublished": "2025-04-07T15:36:46.060Z",
"dateReserved": "2025-04-07T15:05:10.307Z",
"dateUpdated": "2025-04-10T15:42:10.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-3424\",\"sourceIdentifier\":\"20705f08-db8b-4497-8f94-7eea62317651\",\"published\":\"2025-04-07T16:15:27.703\",\"lastModified\":\"2025-04-10T16:15:29.207\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The IntelliSpace portal application utilizes .NET\\nRemoting for its functionality. The vulnerability arises from the exploitation\\nof port 755 through the \\\"Object Marshalling\\\" technique, which allows\\nan attacker to read internal files without any authentication. This is possible\\nby crafting specific .NET Remoting URLs derived from information enumerated in\\nthe client-side configuration files.\\n\\n\\n\\n\\n\\n\\n\\nThis issue affects IntelliSpace Portal: 12 and prior.\"},{\"lang\":\"es\",\"value\":\"La aplicaci\u00f3n de Intellispace Portal utiliza .NET Remoting para su funcionalidad. La vulnerabilidad surge de la explotaci\u00f3n del puerto 755 mediante la t\u00e9cnica de \\\"Object Marshalling\\\", que permite a un atacante leer archivos internos sin autenticaci\u00f3n. Esto es posible mediante la manipulaci\u00f3n de URL espec\u00edficas de .NET Remoting derivadas de la informaci\u00f3n enumerada en los archivos de configuraci\u00f3n del cliente. Este problema afecta a IntelliSpace Portal: 12 y versiones anteriores.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"20705f08-db8b-4497-8f94-7eea62317651\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Green\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"PRESENT\",\"Automatable\":\"YES\",\"Recovery\":\"USER\",\"valueDensity\":\"CONCENTRATED\",\"vulnerabilityResponseEffort\":\"MODERATE\",\"providerUrgency\":\"GREEN\"}}]},\"weaknesses\":[{\"source\":\"20705f08-db8b-4497-8f94-7eea62317651\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2025-3424\",\"source\":\"20705f08-db8b-4497-8f94-7eea62317651\"},{\"url\":\"https://www.philips.com/a-w/security/security-advisories.html#security_advisories\",\"source\":\"20705f08-db8b-4497-8f94-7eea62317651\"}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"modules\": [\"filesystem\"], \"platforms\": [\"Windows\"], \"product\": \"IntelliSpace Portal\", \"vendor\": \"Philips\", \"versions\": [{\"status\": \"affected\", \"version\": \"12 and prior\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Victor A Morales\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Omar A Crespo\"}], \"datePublic\": \"2025-04-07T15:05:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cp\u003eThe IntelliSpace portal application utilizes .NET\\nRemoting for its functionality. The vulnerability arises from the exploitation\\nof port 755 through the \\\"Object Marshalling\\\" technique, which allows\\nan attacker to read internal files without any authentication. This is possible\\nby crafting specific .NET Remoting URLs derived from information enumerated in\\nthe client-side configuration files.\u003c/p\u003e\\n\\n\\n\\n\\n\\n\u003cp\u003eThis issue affects IntelliSpace Portal: 12 and prior.\u003c/p\u003e\"}], \"value\": \"The IntelliSpace portal application utilizes .NET\\nRemoting for its functionality. The vulnerability arises from the exploitation\\nof port 755 through the \\\"Object Marshalling\\\" technique, which allows\\nan attacker to read internal files without any authentication. This is possible\\nby crafting specific .NET Remoting URLs derived from information enumerated in\\nthe client-side configuration files.\\n\\n\\n\\n\\n\\n\\n\\nThis issue affects IntelliSpace Portal: 12 and prior.\"}], \"impacts\": [{\"capecId\": \"CAPEC-126\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-126 Path Traversal\"}]}], \"metrics\": [{\"cvssV4_0\": {\"Automatable\": \"YES\", \"Recovery\": \"USER\", \"Safety\": \"PRESENT\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"attackVector\": \"ADJACENT\", \"baseScore\": 7.7, \"baseSeverity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"providerUrgency\": \"GREEN\", \"subAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"valueDensity\": \"CONCENTRATED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Green\", \"version\": \"4.0\", \"vulnAvailabilityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"20705f08-db8b-4497-8f94-7eea62317651\", \"shortName\": \"Philips\", \"dateUpdated\": \"2025-04-07T15:36:46.060Z\"}, \"references\": [{\"url\": \"https://www.cve.org/CVERecord?id=CVE-2025-3424\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"title\": \"3.2.1 Arbitrary File Read in insecure .NET Remoting TCP Channel\", \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-3424\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-07T16:11:37.059479Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-07T16:11:39.941Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2025-3424\", \"assignerOrgId\": \"20705f08-db8b-4497-8f94-7eea62317651\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Philips\", \"dateReserved\": \"2025-04-07T15:05:10.307Z\", \"datePublished\": \"2025-04-07T15:36:46.060Z\", \"dateUpdated\": \"2025-04-07T16:11:44.627Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…