The VeraSMART application stores static ASP.NET/IIS machineKey values in its web.config file, which protects ViewState data from tampering. An attacker who learns these keys can forge a ViewState payload that passes integrity validation and causes the server to deserialize malicious data, resulting in code execution within the IIS application process. The vulnerability directly exposes the server to compromise, allowing the attacker to run arbitrary code as the application’s identity. The weakness is a hard‑coded secret misuse (CWE‑321).

Calero’s VeraSMART platform, versions released before 2022 R1. The static keys are located under C:\Program Files (x86)\Veramark\VeraSMART\WebRoot\web.config and affect all instances using that configuration.

With a CVSS score of 9.3, the flaw is considered critical, yet the EPSS score of less than 1% indicates a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires either direct access to the web.config file or another method of retrieving the static machineKey values, after which an attacker can craft a malicious ViewState token. The risk is therefore high severity but currently low exploitation likelihood, making timely remediation imperative.