.NET SOAPwn Flaw Opens Door for File Writes and Remote Code Execution via Rogue WSDL
Summary: WatchTowr Labs detailed a .NET Framework flaw it calls SOAPwn, presented by researcher Piotr Bazydlo at Black Hat Europe in London, in which WSDL imports and HTTP client proxies can be manipulated to write arbitrary files and achieve remote code execution in products built on .NET. The issue affects Barracuda Service Center RMM, Ivanti Endpoint Manager, and Umbraco 8, and Microsoft declined to fix it after responsible disclosure in March 2024 and July 2025, stating users should not consume untrusted input that can generate and run code.
Key Takeaway: Barracuda patched its flaw as CVE-2025-34392 with a CVSS score of 9.8 and Ivanti as CVE-2025-13659 at 8.8, but Umbraco 8 reached end-of-life on February 24, 2025, so that exposure remains open with no fix coming.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-13659CVE-2025-34392
- Related
- Fortinet, Ivanti, and SAP Issue Urgent Patches for Authentication and Code Execution Flaws Cyber Risks ·University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026