CVE-2021-26912
📋 TL;DR
CVE-2021-26912 is a critical remote code execution vulnerability in NetMotion Mobility servers that allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges via Java deserialization in SupportRpcServlet. This affects organizations using NetMotion Mobility for VPN/remote access solutions. Attackers can gain complete control over affected servers without any authentication.
💻 Affected Systems
- NetMotion Mobility Server
📦 What is this software?
Netmotion Mobility by Netmotionsoftware
Netmotion Mobility by Netmotionsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Mobility server with SYSTEM privileges, allowing attackers to pivot to internal networks, steal credentials, deploy ransomware, or establish persistent backdoors.
Likely Case
Remote code execution leading to server compromise, data exfiltration, and lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
Exploitation is straightforward due to public proof-of-concept code and the unauthenticated nature of the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.73 or 12.02 and later
Vendor Advisory: https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020
Restart Required: Yes
Instructions:
1. Download and install NetMotion Mobility version 11.73 or 12.02 from the official vendor portal. 2. Apply the update to all affected Mobility servers. 3. Restart the Mobility server services to complete the installation.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the Mobility server's web interface (typically port 443) to only trusted IP addresses or internal networks.
Disable SupportRpcServlet
windowsIf possible, disable or block access to the vulnerable SupportRpcServlet endpoint.
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to Mobility servers
- Deploy web application firewall (WAF) rules to detect and block Java deserialization attacks
🔍 How to Verify
Check if Vulnerable:
Check the NetMotion Mobility server version via the web interface or server console. Versions below 11.73 or 12.x below 12.02 are vulnerable.Check Version:
Check the Mobility server web interface or use the server management console to view the installed version.Verify Fix Applied:
Verify the server version is 11.73 or higher (for 11.x) or 12.02 or higher (for 12.x) after applying the patch.📡 Detection & Monitoring
Log Indicators:
- Unusual Java deserialization errors in Mobility server logs
- Unexpected process creation with SYSTEM privileges
- Access to SupportRpcServlet from untrusted sources
Network Indicators:
- HTTP POST requests to /servlet/SupportRpcServlet from external IPs
- Unusual outbound connections from Mobility server
SIEM Query:
source="mobility_server" AND (uri="/servlet/SupportRpcServlet" OR message="*deserialization*")🔗 References
- https://ssd-disclosure.com/?p=4676
- https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/
- https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020
- https://ssd-disclosure.com/?p=4676
- https://ssd-disclosure.com/ssd-advisory-netmotion-mobility-server-multiple-deserialization-of-untrusted-data-lead-to-rce/
- https://www.netmotionsoftware.com/security-advisories/security-vulnerability-in-mobility-web-server-november-19-2020
