NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because o…

published 2021-02-08 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-13699

cvss: 8.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 43.2%; EPSS 43.2% chance of exploitation in 30 days, percentile 98%
public exploits: 0; none known

NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in webrepdb StatusServlet.

Patch / fix

fixed in 1

netmotionsoftware netmotion_mobility 11.73, 12.02

Exploit prediction

43.23% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

ssd-disclosure.com https://ssd-disclosure.com/?p=4676 referenced PoC, tagged "exploit" by a source, unverified
ssd-disclosure.com https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-502 Deserialization of Untrusted Data

References

ssd-disclosure.com /?p=4676
exploit, third-party-advisory
ssd-disclosure.com /ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/
exploit, third-party-advisory
netmotionsoftware.com /security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020
vendor-advisory

Sources

CVE List CVE-2021-26915
NVD CVE-2021-26915

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary