CVE-2025-66631

CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.

CVSS 4.0

7.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-25)

CWE

CWE-502

Published

2025-12-09

Modified

2026-10-07

Record from

the NVD, synced 2026-10-19

Affected

• cslanet:csla_.net

References

• https://github.com/MarimerLLC/csla/issues/4001
• https://github.com/MarimerLLC/csla/pull/4018
• https://github.com/MarimerLLC/csla/security/advisories/GHSA-wq34-7f4g-953v

Check your stackJSON