CVE-2025-66631
Published: 09 December 2025
Summary
CVE-2025-66631 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Cslanet Csla .Net. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 13.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-66631 is a remote code execution vulnerability in the CSLA .NET framework, which is designed for developing reusable, object-oriented business layers in applications. The issue affects versions 5.5.4 and below, specifically in the WcfProxy component. WcfProxy relies on the now-obsolete NetDataContractSerializer (NDCS) for deserialization, making it susceptible to exploitation during this process. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Any unauthenticated attacker with network access can exploit this vulnerability by sending maliciously crafted serialized data to a vulnerable CSLA .NET application using WcfProxy. The attack requires low complexity and no user interaction, allowing remote code execution on the target system. Successful exploitation enables attackers to achieve high impacts on confidentiality, integrity, and availability, potentially compromising the entire application server.
Mitigation is available in CSLA .NET version 6.0.0, which addresses the vulnerability. As a workaround, remove WcfProxy from data portal configurations. Additional details are provided in the GitHub security advisory (GHSA-wq34-7f4g-953v), issue tracker (#4001), and pull request (#4018).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201825
Vulnerability details
CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization.…
more
This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote code execution via deserialization of untrusted data in a public-facing WCF service component (WcfProxy), directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation addresses the deserialization vulnerability by patching CSLA .NET to version 6.0.0 or implementing the WcfProxy removal workaround.
Least functionality restricts or prohibits the obsolete WcfProxy component, eliminating the vulnerable NetDataContractSerializer deserialization path.
Information input validation checks serialized data before deserialization, mitigating exploitation of untrusted inputs targeting NetDataContractSerializer.