CVE-2025-34153: Hyland OnBase < 17.0.2.87 .NET Remoting TCP Channel Unauthenticated RCE
Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the URI endpoint TimerServer, implemented in Hyland.Core.Timers.dll. This endpoint deserializes untrusted input using the .NET BinaryFormatter, allowing attackers to execute arbitrary code under the context of NT AUTHORITY\SYSTEM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34153?
CVE-2025-34153 has been rated as a critical vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2025-34153?
To mitigate CVE-2025-34153, upgrade Hyland OnBase to version 17.0.2.87 or later.
What versions of Hyland OnBase are affected by CVE-2025-34153?
CVE-2025-34153 affects Hyland OnBase versions prior to 17.0.2.87.
What type of vulnerability is CVE-2025-34153?
CVE-2025-34153 is classified as an insecure deserialization vulnerability that allows remote code execution.
Is authentication required to exploit CVE-2025-34153?
No, CVE-2025-34153 can be exploited without authentication, allowing for remote code execution.