critical9.8
CVE-2023-37286
SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key.
Impact
SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Smartsoft | Smartbpm.Net | Version 6.70 |