Remote Code Execution Vulnerability in Newforma Project Center Server
CVE-2025-35051

7.7HIGH

Key Information:

Vendor

Newforma

Status
Project Center
Vendor
CVE Published:
9 October 2025

What is CVE-2025-35051?

Newforma Project Center Server (NPCS) has a vulnerability that allows remote, unauthenticated attackers to execute arbitrary code via a serialized .NET data input on the '/ProjectCenter.rem' endpoint accessible on port 9003/tcp. Despite the recommendation for internal network access only, misconfigurations can expose this endpoint, potentially allowing attackers to exploit the system under the 'NT AUTHORITY\NetworkService' user context. It is crucial for organizations to restrict access to NPCS and monitor their network configurations to mitigate risks associated with this vulnerability.

Affected Version(s)

Project Center *

Project Center 2024.3

References

https://projectcenter.help.newforma.com/overviews/info_ex...
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
https://www.cve.org/CVERecord?id=CVE-2025-35051

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
JSON
.
CVE-2025-35051 : Remote Code Execution Vulnerability in Newforma Project Center Server