CVE-2025-34153

The service registers a listener on TCP port 6031 with a URI endpoint named TimerServer, implemented in the Hyland.Core.Timers.dll library. The endpoint deserializes untrusted input using the .NET BinaryFormatter class, which is vulnerable to arbitrary code execution during the deserialization process. An attacker can send a crafted payload directly to this port without needing any credentials, resulting in code execution in the context of NT AUTHORITY\SYSTEM.

An attacker can execute arbitrary code with NT AUTHORITY\SYSTEM privileges, which means full takeover of the server, data exfiltration, installation of backdoors, and the ability to perform lateral movement within the internal network.

Hyland OnBase must be updated to version 17.0.2.87 or later (including Foundation 24.1 or higher) in accordance with the vendor's security bulletin OB2025-02. As a temporary workaround, it is recommended to restrict network access to TCP port 6031 only to trusted hosts using a firewall or network segmentation rules.

Hyland OnBase in versions earlier than 17.0.2.87; other product versions may also be vulnerable — the exact scope is indicated in the vendor's references