Summary
A service console in openPDC and openHistorian deserializes data structures supplied by clients, allowing an attacker to cause arbitrary object graphs to be processed. Depending on authentication settings, an attacker may need valid authentication or may reach the function without authentication, potentially enabling remote code execution as the affected service account.
A service console in openPDC and openHistorian deserializes data structures supplied by clients, allowing an attacker to cause arbitrary object graphs to be processed. Depending on authentication settings, an attacker may need valid authentication or may reach the function without authentication, potentially enabling remote code execution as the affected service account.
Affected context
The vulnerability occurs in the service console interface of openPDC and openHistorian when client-supplied data is deserialized without sufficiently restricting the types or object structures that can be instantiated. Systems using Windows Authentication may limit access to authenticated users, while deployments without that control may expose the function to unauthenticated network clients.
The vulnerability occurs in the service console interface of openPDC and openHistorian when client-supplied data is deserialized without sufficiently restricting the types or object structures that can be instantiated. Systems using Windows Authentication may limit access to authenticated users, while deployments without that control may expose the function to unauthenticated network clients.
Exploit preconditions
- Attack surface: Network-accessible service console interface
- Required access: Valid authentication where Windows Authentication is enabled; potentially no authentication where it is disabled
- Trigger point: Processing of a client-supplied serialized data structure
- Why exploitation is possible: The service accepts and deserializes an arbitrary object graph without adequately constraining permitted object types
- Attack surface: Network-accessible service console interface
- Required access: Valid authentication where Windows Authentication is enabled; potentially no authentication where it is disabled
- Trigger point: Processing of a client-supplied serialized data structure
- Why exploitation is possible: The service accepts and deserializes an arbitrary object graph without adequately constraining permitted object types
Why this happens
The underlying bug is unsafe deserialization, mapped to CWE-502. A client-controlled serialized structure is treated as a valid object graph and reconstructed by the service without a sufficiently restrictive type allowlist or equivalent safety boundary. If the deserialization mechanism permits dangerous object construction, specially crafted input may cause code to run during or after object reconstruction.
The underlying bug is unsafe deserialization, mapped to CWE-502. A client-controlled serialized structure is treated as a valid object graph and reconstructed by the service without a sufficiently restrictive type allowlist or equivalent safety boundary. If the deserialization mechanism permits dangerous object construction, specially crafted input may cause code to run during or after object reconstruction.
Potential impact
- An attacker may execute arbitrary code on the host
- The affected service account could be compromised
- The attacker could alter, delete, or disclose operational data
- The compromise could enable lateral movement or disruption of monitoring services
- An attacker may execute arbitrary code on the host
- The affected service account could be compromised
- The attacker could alter, delete, or disclose operational data
- The compromise could enable lateral movement or disruption of monitoring services
General mitigation guidance
Mitigation generally focuses on eliminating unsafe deserialization of
client-controlled data and reducing the privileges available to the service.
Common defensive patterns include:
- Replacing general-purpose deserialization with safe, data-only formats and parsers
- Enforcing strict schemas and type allowlists before accepting structured input
- Treating all network-supplied serialized data as untrusted
- Restricting console exposure to trusted networks and requiring strong authentication
- Running the affected service with least privilege and isolated service identities
- Applying network segmentation and minimizing the service account's access to host and operational resources
Mitigation generally focuses on eliminating unsafe deserialization of
client-controlled data and reducing the privileges available to the service.
Common defensive patterns include:
- Replacing general-purpose deserialization with safe, data-only formats and parsers
- Enforcing strict schemas and type allowlists before accepting structured input
- Treating all network-supplied serialized data as untrusted
- Restricting console exposure to trusted networks and requiring strong authentication
- Running the affected service with least privilege and isolated service identities
- Applying network segmentation and minimizing the service account's access to host and operational resources
How teams detect issues like this
Organizations can look for:
- Static-analysis findings involving general-purpose deserialization APIs
- Code paths that reconstruct types or object graphs from network input
- Review signals showing missing type allowlists, schema validation, or authentication checks
- Network monitoring for unexpected connections to service console ports
- Policy enforcement requiring authenticated, segmented access to administrative interfaces
- Automated code-review tools that flag unsafe deserialization patterns and untrusted data flows
Organizations can look for:
- Static-analysis findings involving general-purpose deserialization APIs
- Code paths that reconstruct types or object graphs from network input
- Review signals showing missing type allowlists, schema validation, or authentication checks
- Network monitoring for unexpected connections to service console ports
- Policy enforcement requiring authenticated, segmented access to administrative interfaces
- Automated code-review tools that flag unsafe deserialization patterns and untrusted data flows
