Arbitrary Deserialization Vulnerability in Cerberus DMS and Desigo CC Products

CVE-2021-37181

What is CVE-2021-37181?

A vulnerability in Cerberus DMS and Desigo CC products allows for arbitrary deserialization of untrusted data due to insufficient validation measures. This security flaw can be exploited by an unauthenticated attacker, potentially leading to code execution on the affected systems. Both the CCOM communication component, responsible for facilitating Windows App / Click-Once and IE Web / XBAP client connectivity, are particularly vulnerable, emphasizing the need for prompt updates to mitigate potential exploits.

References