INTEGRA32 SECURITY MANAGEMENT SYSTEM · CVE-2026-63079 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Integra32 Security Management System 5.1.11 R5.0 exposes a deprecated .NET Remoting service on TCP port 2001 that deserializes untrusted data without authentication. A remote attacker can send a crafted payload to run code as NT AUTHORITY\SYSTEM, or read and write files and capture SMB/NTLMv2 credentials.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Integra32 Security Management System 5.1.11 R5.0, where the .NET Remoting service on TCP port 2001 is reachable from the network. The sources do not say whether the service is enabled by default, so check whether port 2001 is reachable from other hosts. Systems where the port is blocked from untrusted networks are less exposed.
Not affected if other-versions, port-2001-blocked
Who cares .net-remoting, industrial-control, integra32, rbh-access-technologies, self-hosted, windows
5.1.11 R5.05.1.16 as its current R5 release, but no source ties it to this CVERBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.