CVE-2025-66631: CSLA .NET is vulnerable to Remote Code Execution via WcfProxy
Impact Versions of CSLA .NET prior to version 6 allow the use of WcfProxy. WcfProxy uses the NetDataContractSerializer (NDCS) which has known vulnerabilities that can allow remote execution of code during deserialization. NDCS itself is considered obsolete, and you should avoid using WcfProxy or upgrade to CSLA 6 or higher where this issue does not exist.
Patches CSLA .NET version 6 and higher do not use WCF or NetDataContractSerializer.
Workarounds If you are using a version CSLA .NET older than version 6, you should stop using WcfProxy in your data portal configuration. Doing this avoids the use of WCF and the NetDataContractSerializer, avoiding the vulnerability.
Other sources
CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66631?
CVE-2025-66631 is considered a critical vulnerability due to its potential for remote code execution through deserialization.
How do I fix CVE-2025-66631?
To address CVE-2025-66631, upgrade to CSLA .NET version 6.0.0 or later, which removes the vulnerable WcfProxy functionality.
What versions are affected by CVE-2025-66631?
CVE-2025-66631 affects all versions of CSLA .NET prior to 6.0.0.
What are the risks associated with CVE-2025-66631?
The risks associated with CVE-2025-66631 include potential remote code execution and exploitation of the application by attackers.
Is WcfProxy safe to use in my application related to CVE-2025-66631?
WcfProxy is not safe to use in applications affected by CVE-2025-66631 due to its reliance on the vulnerable NetDataContractSerializer.