CVE-2021-26914: NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java…

PriorityP182high8.1CVSS 3.1

AVNACHPRNUINSUCHIHAH

EXPLOIT

EPSS

77.67%

99.5th percentile

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
netmotionsoftware	netmotion_mobility	< 11.73	11.73
netmotionsoftware	netmotion_mobility	>= 12.0 < 12.02	12.02

Detection & IOCsextracted from sources · hover to see the quote

url/mobility/Menu/isLoggedOn↗

→Monitor for unauthenticated HTTP requests to the /mobility/Menu/isLoggedOn endpoint containing serialized Java object payloads, which may indicate exploitation of CVE-2021-26914 via MvcUtil.valueStringToObject() deserialization. ↗
→Alert on any process spawned as SYSTEM originating from the NetMotion Mobility server process, which may indicate successful remote code execution via Java deserialization. ↗
→Unauthenticated remote attackers can exploit this vulnerability; look for requests to the vulnerable endpoint that do not carry valid session/authentication tokens. ↗

·Vulnerable versions are NetMotion Mobility 11.x before 11.73 and 12.x before 12.02; detections should be scoped to these versions. ↗

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.