CVE-2025-35051: Newforma Project Center RCE Vulnerability

CVE-2025-35051 Overview

CVE-2025-35051 is a critical insecure deserialization vulnerability affecting Newforma Project Center Server (NPCS). The server accepts serialized .NET data via the /ProjectCenter.rem endpoint on port 9003/tcp, enabling remote, unauthenticated attackers to execute arbitrary code with NT AUTHORITY\NetworkService privileges. This vulnerability poses a significant risk to organizations using NPCS for project information management in architecture, engineering, and construction industries.

Critical Impact

Remote unauthenticated attackers can achieve arbitrary code execution on vulnerable Newforma Project Center Servers, potentially leading to complete system compromise, data exfiltration, lateral movement, and persistence within the network.

Affected Products

• Newforma Project Center 2024.3
• Newforma Project Center Server (NPCS) exposing /ProjectCenter.rem endpoint on port 9003/tcp
• Organizations using default NPCS configurations without network segmentation

Discovery Timeline

• 2025-10-09 - CVE-2025-35051 published to NVD
• 2026-01-09 - Last updated in NVD database

Technical Details for CVE-2025-35051

Vulnerability Analysis

This vulnerability stems from the insecure handling of .NET serialized data at the /ProjectCenter.rem endpoint. Newforma Project Center Server uses .NET Remoting, which is susceptible to deserialization attacks when exposed to untrusted input. The endpoint on port 9003/tcp accepts serialized objects without proper authentication or input validation, allowing attackers to craft malicious serialized payloads that execute arbitrary code upon deserialization.

The weakness is classified as CWE-306 (Missing Authentication for Critical Function), indicating that the vulnerable endpoint lacks proper authentication controls before processing potentially dangerous serialized data. When combined with .NET deserialization capabilities, this creates a direct path to remote code execution.

Root Cause

The root cause of CVE-2025-35051 is the missing authentication mechanism on the /ProjectCenter.rem endpoint. The NPCS service processes incoming serialized .NET objects without verifying the identity or authorization of the requesting party. Additionally, the .NET Remoting infrastructure used by this endpoint inherently trusts serialized data, which can contain object graphs that trigger code execution during the deserialization process.

.NET Remoting has known security limitations and Microsoft has deprecated it in favor of more secure alternatives like WCF or gRPC. The combination of an unauthenticated endpoint with .NET Remoting's deserialization capabilities creates an exploitable attack surface.

Attack Vector

The attack vector is network-based, requiring the attacker to reach port 9003/tcp where the NPCS endpoint is listening. According to the recommended architecture, this endpoint should only be accessible on internal networks. However, misconfigured networks, compromised internal hosts, or improper firewall rules could expose this service to wider attack surfaces.

An attacker would craft a malicious serialized .NET object containing gadgets that execute arbitrary commands when deserialized. Common .NET deserialization gadget chains can be leveraged using tools like ysoserial.net to generate payloads that achieve code execution. The resulting code runs with NT AUTHORITY\NetworkService privileges, providing significant access to the compromised system.

The exploitation mechanism involves sending a crafted HTTP request to the /ProjectCenter.rem endpoint containing a malicious serialized payload. The server deserializes the payload without authentication checks, triggering the embedded gadget chain and executing the attacker's code. For additional technical context, refer to the CISA CSAF Advisory for this vulnerability.

Detection Methods for CVE-2025-35051

Indicators of Compromise

• Unexpected network connections to port 9003/tcp from external or unauthorized internal hosts
• Unusual process execution spawned by the NPCS service process with NT AUTHORITY\NetworkService context
• HTTP requests to /ProjectCenter.rem containing suspicious binary or Base64-encoded payloads
• Evidence of .NET deserialization tools or ysoserial.net artifacts in network traffic or logs

Detection Strategies

• Monitor network traffic to port 9003/tcp for connections from unauthorized sources or unusual geographic locations
• Implement endpoint detection rules to identify child processes spawned by the Newforma Project Center Server service
• Deploy network intrusion detection signatures for known .NET deserialization attack patterns
• Review Windows Security Event logs for process creation events (Event ID 4688) associated with the NPCS service account

Monitoring Recommendations

• Configure firewall logging to capture all connection attempts to port 9003/tcp
• Enable verbose logging on the Newforma Project Center Server if available
• Implement SIEM correlation rules to detect anomalous behavior from the NetworkService account
• Monitor for lateral movement indicators following any suspicious activity on NPCS hosts

How to Mitigate CVE-2025-35051

Immediate Actions Required

• Restrict network access to the NPCS endpoint on port 9003/tcp to only authorized internal hosts
• Implement firewall rules to block external access to the vulnerable endpoint
• Segment the network to isolate NPCS servers from general user populations
• Review and audit existing access to NPCS infrastructure for unauthorized connections

Patch Information

No vendor patch information is currently available in the CVE data. Organizations should monitor Newforma's official security communications for updates. For product documentation, refer to the Newforma Info Exchange Overview. The official CVE record should be monitored for updates on remediation guidance.

Workarounds

• Implement strict firewall rules limiting access to port 9003/tcp from only trusted, authenticated systems
• Deploy network segmentation to isolate NPCS servers in a dedicated VLAN with controlled access
• Consider placing a reverse proxy with authentication in front of the NPCS endpoint if business requirements allow
• Monitor and alert on any connection attempts to the vulnerable endpoint from unexpected sources

# Example Windows Firewall rule to restrict access to NPCS endpoint
# Allow only specific trusted IP ranges to access port 9003
netsh advfirewall firewall add rule name="Restrict NPCS Access" dir=in action=block protocol=tcp localport=9003
netsh advfirewall firewall add rule name="Allow NPCS from Trusted Network" dir=in action=allow protocol=tcp localport=9003 remoteip=10.0.0.0/24