{"id":"CVE-2026-63079","kind":"vulnerability","aliases":["CVE-2026-63079"],"related":[],"title":"RBH Integra32: unauthenticated .NET Remoting flaw gives remote SYSTEM code execution","description":"RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\\SYSTEM and fully compromise the host.","summary":"Integra32 Security Management System 5.1.11 R5.0 exposes a deprecated .NET Remoting service on TCP port 2001 that deserializes untrusted data without authentication. A remote attacker can send a crafted payload to run code as NT AUTHORITY\\SYSTEM, or read and write files and capture SMB/NTLMv2 credentials.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Integra32 Security Management System","fixed":[],"affected":"<= 5.1.11 R5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":[".net-remoting","industrial-control","infrastructure","integra32","rbh-access-technologies","self-hosted","windows"],"not_affected_if":["other-versions","port-2001-blocked"],"how_to_check":"Check whether the Integra32 server listens on TCP 2001 (netstat -ano | findstr :2001) and whether AxcvcLt.dll is in the install directory. Affected per VulnCheck: Integra32 <= 5.1.11 R5.0. Whether port 2001 is on by default is not stated by the sources. Also check from another host whether 2001 is reachable.","fix":"No vendor advisory or fixed version found. RBH lists 5.1.16 as its current R5 release, but no source ties it to this CVE. Ask RBH. Until then, block TCP 2001 at the firewall except from trusted Integra32 clients and keep the server off the internet.","status":"open","published_at":"2026-11-13T16:19:30+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","triaged_at":"2026-11-13T16:48:13+00:00","updated_at":"2026-11-13T16:49:03+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-13T16:48:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"RBH Integra32: unauthenticated .NET Remoting flaw gives remote SYSTEM code execution","impact":"high","summary":"Integra32 Security Management System 5.1.11 R5.0 exposes a deprecated .NET Remoting service on TCP port 2001 that deserializes untrusted data without authentication. A remote attacker can send a crafted payload to run code as NT AUTHORITY\\SYSTEM, or read and write files and capture SMB/NTLMv2 credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["integra32","rbh-access-technologies","windows",".net-remoting","industrial-control"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote code execution as SYSTEM, full host compromise","analyst_note":"Find the vendor fix or mitigation for Integra32 5.1.11 R5.0 and confirm whether TCP 2001 is enabled by default; the VulnCheck advisory may have details.","how_to_check":"- Check whether the Integra32 server listens on TCP port `2001`, for example with `netstat -ano | findstr 2001` on Windows.\n- Look for `AxcvcLt.dll` in the Integra32 installation directory.\n- Confirm the installed version with the Integra32 application; the sources name `5.1.11 R5.0` as affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["port-2001-blocked","other-versions"],"who_is_affected":"Sites running the Integra32 Security Management System 5.1.11 R5.0, where the .NET Remoting service on TCP port 2001 is reachable from the network. The sources do not say whether the service is enabled by default, so check whether port 2001 is reachable from other hosts. Systems where the port is blocked from untrusted networks are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000828,"input_tokens":4764,"output_tokens":703,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor fix or mitigation for Integra32 5.1.11 R5.0 and confirm whether TCP 2001 is enabled by default; the VulnCheck advisory may have details.","search":"'-2026':13A,16A '-63079':14A,17A '2001':53B,108C '5.1.11':42B,91C 'access':32B,85C 'achiev':155C 'arbitrari':147C 'attack':62B,123C 'authent':59B,119C 'author':73B,161C 'axcvclt.dll':111C 'binaryserverformattersinkprovid':114C 'captur':81B 'chain':136C 'code':10A,70B,157C 'coercion':153C 'compromis':165C 'contain':93C 'control':27B 'craft':66B 'credenti':83B,152C 'cve':12A,15A 'data':57B 'deprec':46B,100C 'deseri':55B,96C 'endpoint':141C 'execut':11A,158C 'exploit':143C 'expos':44B,104C 'file':79B,148C 'flaw':6A 'fulli':164C 'gadget':129C 'give':7A 'host':36B,167C 'industri':26B 'industrial-control':25B 'infrastructur':28B 'integra32':2A,18A,29B,38B,87C 'integrauri':139C 'librari':112C 'malici':127C 'manag':40B,89C 'management':20A 'marshalbyrefobject/marshalbyvalue':144C 'net':4A,23B,47B,101C 'net-remot':22B 'nt':72B,160C 'object':140C 'payload':67B,130C 'port':52B,107C 'r5.0':43B,92C 'rbh':1A,31B,84C 'rbh-access-technolog':30B 'read':76B 'read/write':149C 'remot':5A,8A,24B,48B,61B,102C,121C,156C 'requir':118C 'run':69B 'secur':39B,88C 'security':19A 'self':35B 'self-host':34B 'send':64B,125C 'serial':128C 'servic':49B,103C 'smb/ntlmv2':82B,151C 'system':9A,21A,41B,74B,90C,162C 'tcp':51B,106C 'technolog':33B,86C 'typeconfusedeleg':135C 'typefilterlevel.full':116C 'unauthent':3A,95C,122C 'unmarshal':145C 'untrust':56B 'use':113C 'via':109C 'vulner':97C 'window':37B 'without':58B,117C 'write':78B 'ysoserial.net':134C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Integra32 Security Management System 5.1.11 R5.0, where the .NET Remoting service on TCP port 2001 is reachable from the network. The sources do not say whether the service is enabled by default, so check whether port 2001 is reachable from other hosts. Systems where the port is blocked from untrusted networks are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["integra32securitymanagementsystem","securitymanagementsystem"],"ptokens":["integra32","management","security","system"],"labels":["critical","industrialcontrol","infrastructure","integra32","netremoting","rbhaccesstechnologies","selfhosted","windows"],"campaign_type":null,"search_a":"'-2026':13A,16A '-63079':14A,17A 'code':10A 'cve':12A,15A 'execut':11A 'flaw':6A 'give':7A 'integra32':2A,18A 'management':20A 'net':4A 'rbh':1A 'remot':5A,8A 'security':19A 'system':9A,21A 'unauthent':3A","search_b":"'2001':53B '5.1.11':42B 'access':32B 'attack':62B 'authent':59B 'author':73B 'captur':81B 'code':70B 'control':27B 'craft':66B 'credenti':83B 'data':57B 'deprec':46B 'deseri':55B 'expos':44B 'file':79B 'host':36B 'industri':26B 'industrial-control':25B 'infrastructur':28B 'integra32':29B,38B 'manag':40B 'net':23B,47B 'net-remot':22B 'nt':72B 'payload':67B 'port':52B 'r5.0':43B 'rbh':31B 'rbh-access-technolog':30B 'read':76B 'remot':24B,48B,61B 'run':69B 'secur':39B 'self':35B 'self-host':34B 'send':64B 'servic':49B 'smb/ntlmv2':82B 'system':41B,74B 'tcp':51B 'technolog':33B 'untrust':56B 'window':37B 'without':58B 'write':78B","search_c":"'2001':108C '5.1.11':91C 'access':85C 'achiev':155C 'arbitrari':147C 'attack':123C 'authent':119C 'author':161C 'axcvclt.dll':111C 'binaryserverformattersinkprovid':114C 'chain':136C 'code':157C 'coercion':153C 'compromis':165C 'contain':93C 'credenti':152C 'deprec':100C 'deseri':96C 'endpoint':141C 'execut':158C 'exploit':143C 'expos':104C 'file':148C 'fulli':164C 'gadget':129C 'host':167C 'integra32':87C 'integrauri':139C 'librari':112C 'malici':127C 'manag':89C 'marshalbyrefobject/marshalbyvalue':144C 'net':101C 'nt':160C 'object':140C 'payload':130C 'port':107C 'r5.0':92C 'rbh':84C 'read/write':149C 'remot':102C,121C,156C 'requir':118C 'secur':88C 'send':125C 'serial':128C 'servic':103C 'smb/ntlmv2':151C 'system':90C,162C 'tcp':106C 'technolog':86C 'typeconfusedeleg':135C 'typefilterlevel.full':116C 'unauthent':95C,122C 'unmarshal':145C 'use':113C 'via':109C 'vulner':97C 'without':117C 'ysoserial.net':134C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:19:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63079","severity":null,"published_at":"2026-11-13T16:19:30+00:00","modified_at":"2026-11-13T16:19:30+00:00","first_seen_at":"2026-11-13T16:47:35+00:00","fetched_at":"2026-11-13T16:47:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-63079:3903","url":null,"severity":null,"published_at":"2026-11-13T16:49:03+00:00","modified_at":"2026-11-13T16:49:03+00:00","first_seen_at":"2026-11-13T16:49:03+00:00","fetched_at":"2026-11-13T16:49:03+00:00","note":"Read VulnCheck advisory (third-party, not vendor). No RBH advisory or fix found; RBH support page lists Integra32 R5 v5.1.16 as current release but states nothing about this CVE, so fix unknown. Port 2001 default-enabled not stated by any source. Nothing verified."}],"documents":[{"id":147676,"url":"https://www.vulncheck.com/advisories/rbh-integra32-net-remoting-deserialization-rce","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}