CVE-2025-66631 Details
Description
CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.
A remote code execution vulnerability has been identified in CSLA .NET framework versions prior to 6.0.0. This issue arises from the use of WcfProxy, which relies on the now-obsolete NetDataContractSerializer (NDCS) for serialization. During the deserialization process, NDCS introduces a risk of executing malicious code. The vulnerability is present in versions 5.5.4 and below.
To address this vulnerability, users should upgrade to CSLA .NET version 6.0.0 or later, where the issue has been resolved. If an upgrade is not possible, WcfProxy should be removed from the data portal configurations in versions prior to 6.0.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 9, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MarimerLLC/csla/issues/4001 | [email protected] | Issue Tracking |
| https://github.com/MarimerLLC/csla/pull/4018 | [email protected] | Issue TrackingPatch |
| https://github.com/MarimerLLC/csla/security/advisories/GHSA-wq34-7f4g-953v | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cslanet csla .net | < 6.0.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Reanalysis | [email protected] |
| Mar 25, 2026 | Reanalysis | [email protected] |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Dec 9, 2025 | New CVE Received | [email protected] |