CVE-2025-58384
Published: 26 September 2025
Summary
CVE-2025-58384 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Doxense (inferred from references). Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-58384 is a deserialization of untrusted data vulnerability (CWE-502) affecting DOXENSE WATCHDOC versions prior to 6.1.1.5332. The flaw resides in the Watchdoc administration interface and stems from unsafe handling of serialized data via the .NET Remoting library, which can be abused to execute arbitrary code on the server.
An unauthenticated remote attacker can send a crafted serialized payload over the network to the exposed administration interface. Successful exploitation grants full remote code execution with the privileges of the Watchdoc process, enabling complete compromise of the affected system including confidentiality, integrity, and availability impacts.
The vendor advisory at doc.doxense.com and the update site at update.doxense.com direct administrators to upgrade to version 6.1.1.5332 or later to remediate the issue.
The associated EPSS score has remained flat at 0.0221 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31375
Vulnerability details
In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interface.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated RCE via deserialization in network-exposed admin interface directly enables exploitation of public-facing applications for initial access and code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely remediation of flaws like this deserialization vulnerability by applying the vendor patch to version 6.1.1.5332 or later, directly preventing exploitation.
SI-10 mandates validation of untrusted inputs to the .NET Remoting library in the Watchdoc administration interface, blocking malicious deserialized data that leads to RCE.
SC-7 enforces network boundary protections to restrict unauthenticated remote access to the vulnerable administration interface, preventing attackers from reaching and exploiting the deserialization flaw.