#Ease diagnostics version 11 update update#
#Ease diagnostics version 11 update software#

NetMotion Mobility v10.x servers and clientsĬustomers running Mobility v10.x or Mobile IQ v1.x should plan to migrate to the latest versions.

#Ease diagnostics version 11 update software#

ĬVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hįor more information, please contact Software is providing customers with advance notice of the end of life (EOL) for the following:

#Ease diagnostics version 11 update update#

NetMotion thanks SSD Disclosure for their professionalism in bringing these vulnerabilities to our attention, working with us under the principles of responsible disclosure, and ensuring that our customers had an opportunity to update their systems prior to releasing any details.įor more details on these vulnerabilities, visit SSD Disclosure. Mobility v11.73 and v12.02 fixed these vulnerabilities and mitigated future exploitation of this class of attack by implementing a safe Java object reader and cryptographic validation of input prior to deserialization where appropriate. Customers who have followed NetMotion’s recommendations for secure deployment are only vulnerable to this attack from inside their protected network where the Mobility web server is deployed. Successful exploitation results in remote code execution with system privileges without prior authentication. Prior to Mobility v11.73 and v12.02, attackers with access to the Mobility web server, which hosts the Mobility management console and some inter-server communications processes, could exploit Java deserialization vulnerabilities. If you have changed the default VPN port, ensure that only the VPN port is exposed. The default port for the VPN is UDP 5008. In addition, customers should verify that their Mobility servers are behind a commercial firewall and that only the VPN port is exposed to untrusted networks. Consult the Mobility v11.73 and v12.02 or later documentation for guidance on securely configuring your Mobility deployment. Customers should upgrade immediately to these or later versions.ĭownload the updated versions of Mobility servers from the NetMotion customer portal, or contact support for assistance.

The vulnerabilities were fixed in versions Mobility v11.73 and v12.02, which were released on November 19, 2020.

The CVSS 3.1 base score for these vulnerabilities is 8.1 (High) On November 19, 2020, NetMotion alerted customers to security vulnerabilities in the Mobility web server and released updates for Mobility v11.x and v12.x to address them.