CVE-2025-69276
Published: 12 January 2026
Summary
CVE-2025-69276 is a low-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Broadcom Dx Netops Spectrum. Its CVSS base score is 2.3 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69276 is a Deserialization of Untrusted Data vulnerability (CWE-502) in Broadcom DX NetOps Spectrum on Windows and Linux platforms. The flaw allows Object Injection and affects DX NetOps Spectrum versions 24.3.13 and earlier. Published on 2026-01-12, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility and potential for significant impacts.
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), allowing object injection that could lead to arbitrary code execution or other severe compromises within the affected Spectrum instance.
The Broadcom security advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36756 provides details on mitigation strategies and available patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1950
Vulnerability details
Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: 24.3.13 and earlier.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability enables low-privileged remote attackers to perform object injection leading to arbitrary code execution, directly facilitating Exploitation of Remote Services (T1210) and Exploitation for Privilege Escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the deserialization of untrusted data vulnerability by applying vendor-provided patches for affected DX NetOps Spectrum versions.
Validates untrusted input data prior to deserialization to prevent object injection attacks exploiting CWE-502.
Provides memory protections such as DEP and ASLR to mitigate exploitation consequences like arbitrary code execution from deserialization flaws.