CVE-2025-35051
Published: 09 October 2025
Summary
CVE-2025-35051 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Newforma Project Center. Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-35051 is a critical vulnerability in Newforma Project Center Server (NPCS) that enables remote code execution through the acceptance of serialized .NET data via the '/ProjectCenter.rem' endpoint on TCP port 9003. This flaw stems from deserialization of untrusted data (CWE-502) combined with missing authentication for a critical function (CWE-306), earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote, unauthenticated attacker who can reach the vulnerable endpoint can send crafted serialized .NET payloads to execute arbitrary code running with 'NT AUTHORITY\NetworkService' privileges, potentially leading to full system compromise on the affected server.
According to advisories, the recommended architecture limits the NPCS endpoint to internal network access only; mitigation requires restricting network access to NPCS. Further details are provided in references including https://projectcenter.help.newforma.com/overviews/info_exchange_overview/, https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json, and https://www.cve.org/CVERecord?id=CVE-2025-35051.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-33576
Vulnerability details
Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible…
more
on an internal network. To mitigate this vulnerability, restrict network access to NPCS.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote code execution via exploitation of a public-facing .NET remoting endpoint, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces boundary protection to restrict network access to the vulnerable NPCS '/ProjectCenter.rem' endpoint on TCP/9003, directly implementing the recommended mitigation of limiting exposure to internal networks only.
Validates untrusted serialized .NET data inputs to prevent deserialization of malicious payloads exploiting CWE-502.
Enforces approved authorizations and authentication for access to the critical endpoint, addressing the unauthenticated remote code execution via CWE-306.