Calero VeraSMART versions before 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service exposes default ObjectURIs and allows unfiltered SOAP or binary deserialization with a TypeFilterLevel of Full. An attacker can invoke these endpoints to read or write arbitrary files via the WebClient class, including sensitive configuration files that contain IIS machineKey and decryption keys. With those keys, the attacker can craft a malicious ViewState payload and achieve remote code execution inside the IIS application context. The vulnerability also permits supply of UNC paths, causing outbound SMB authentication that can leak NTLMv2 hashes for relay or offline cracking.

Vendors: Calero; Product: VeraSMART; Targeted versions: any installation prior to 2022 R1. No specific version numbers are available beyond the 2022 R1 release milestone, making all older releases susceptible. The remote .NET Remoting service runs on the standard HTTP port 8001 and is accessible without authentication.

The CVSS score of 10 indicates a critical security impact. Despite a low EPSS of less than 1%, the vulnerability remains a significant risk because it allows unauthenticated remote exploitation without requiring privileged access or complex prerequisites. The attack vector is clear: an external actor connects to port 8001, invokes a deserialized endpoint, and performs file operations or crafts a ViewState payload. Although the probability of exploitation in the wild is low, the potential for full server compromise and credential theft is high. The vulnerability is not currently listed in the CISA KEV catalog, but its severity warrants urgent action.