CVE-2023-37286
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
SmartSoft SmartBPM.NET has a vulnerability related to the use of a hard-coded machine key. An unauthenticated remote attacker can exploit this key to send serialized payloads to the server to execute arbitrary code and disrupt service.
Risk Assessment
This vulnerability poses a risk of arbitrary code execution by an attacker, potentially leading to significant service disruption and data loss.
Recommendation
It is recommended to remove the hard-coded machine key and replace it with a dynamically generated key to minimize the risk of unauthorized access.
Original NVD description (English source)
SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.