Security Advisory
CVE-2025-35050
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
Newforma Info Exchange (NIX) accepts serialized .NET data via the /remoteweb/remote.rem endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with NT AUTHORITYNetworkService privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the /remoteweb/remote.rem endpoint, for example using the IIS URL Rewrite Module.