CVE-2025-66631

CriticalRCE

Published: 09 December 2025

Published

09 December 2025

Modified

25 March 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0282 86.3th percentile

Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-66631 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Cslanet Csla .Net. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Timely flaw remediation addresses the deserialization vulnerability by patching CSLA .NET to version 6.0.0 or implementing the WcfProxy removal workaround.

CM-7 Least Functionality good match

prevent

Least functionality restricts or prohibits the obsolete WcfProxy component, eliminating the vulnerable NetDataContractSerializer deserialization path.

SI-10 Information Input Validation partial match

prevent

Information input validation checks serialized data before deserialization, mitigating exploitation of untrusted inputs targeting NetDataContractSerializer.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability allows unauthenticated remote code execution via deserialization of untrusted data in a public-facing WCF service component (WcfProxy), directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization.…

This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.

Deeper analysisAI

CVE-2025-66631 is a remote code execution vulnerability in the CSLA .NET framework, which is designed for developing reusable, object-oriented business layers in applications. The issue affects versions 5.5.4 and below, specifically in the WcfProxy component. WcfProxy relies on the now-obsolete NetDataContractSerializer (NDCS) for deserialization, making it susceptible to exploitation during this process. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Any unauthenticated attacker with network access can exploit this vulnerability by sending maliciously crafted serialized data to a vulnerable CSLA .NET application using WcfProxy. The attack requires low complexity and no user interaction, allowing remote code execution on the target system. Successful exploitation enables attackers to achieve high impacts on confidentiality, integrity, and availability, potentially compromising the entire application server.

Mitigation is available in CSLA .NET version 6.0.0, which addresses the vulnerability. As a workaround, remove WcfProxy from data portal configurations. Additional details are provided in the GitHub security advisory (GHSA-wq34-7f4g-953v), issue tracker (#4001), and pull request (#4018).