High severity · published Apr 7, 2025
CVE-2025-3425
Unauthenticated Remote Code Execution via .NET Deserialization
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deserialization vulnerability. After analyzing the configuration files, we observed that the server had set the TypeFilterLevel to Full which is dangerous as it can potentially lead to remote code execution using deserialization. This issue affects IntelliSpace Portal: 12 and prior.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
IntelliSpace Portal · Philips
12 and prior · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3425
www.cve.org
https://www.cve.org/CVERecord?id=CVE-2025-3425
www.philips.com
https://www.philips.com/a-w/security/security-advisories.html#security_advisories
More from IntelliSpace Portal
8.8
CVE-2017-0143
Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
7.8
CVE-2017-0199
Microsoft Office and WordPad Remote Code Execution Vulnerability
9.8
CVE-2018-5474
Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execute arbitrary code or cause the…
9.8
CVE-2018-5472
Philips Intellispace Portal all versions 7.0.x and 8.0.x have an insecure windows permissions vulnerability that could allow an attacker to gain unauthorized access and in some…
9.8
CVE-2018-5468
Philips Intellispace Portal all versions 7.0.x and 8.0.x have a remote desktop access vulnerability that could allow an attacker to gain unauthorized access and in some cases…