CVE-2021-26914

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
https://ssd-disclosure.com/?p=4676Exploit, Third Party Advisory
https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/Exploit, Third Party Advisory
https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020Vendor Advisory
http://packetstormsecurity.com/files/162617/NetMotion-Mobility-Server-MvcUtil-Java-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
https://ssd-disclosure.com/?p=4676Exploit, Third Party Advisory
https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/Exploit, Third Party Advisory
https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020Vendor Advisory

Timeline

Published: Feb 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-269158.1NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of CVE-2021-269166.1In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML t CVE-2021-269175.5PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value CVE-2021-269189.8The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user CVE-2021-269198.8Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper CVE-2021-269206.5In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows aut CVE-2021-269216.5In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled.CVE-2021-269237.5An issue was discovered in Argo CD before 1.8.4. Accessing the endpoint /api/version leaks internal information for the system, and this end CVE-2021-269246.1An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.CVE-2021-269255.4Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.CVE-2021-269267.1A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of inform CVE-2021-269275.5A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of serv