关键漏洞信息 标题 Remote Code Execution via WcfProxy (NetDataContractSerializer) 严重性 High 影响 Affected Versions: = 6 描述 Versions of CSLA .NET prior to version 6 allow the use of WcfProxy. WcfProxy uses the NetDataContractSerializer (NDCS) which has known vulnerabilities that can allow remote execution of code during deserialization. NDCS itself is considered obsolete, and you should avoid using WcfProxy or upgrade to CSLA 6 or higher where this issue does not exist. 补丁 CSLA .NET version 6 and higher do not use WCF or NetDataContractSerializer. 解决方案 If you are using a version CSLA .NET older than version 6, you should stop using WcfProxy in your data portal configuration. Doing this avoids the use of WCF and the NetDataContractSerializer, avoiding the vulnerability. 引用 CA2310: Do not use insecure deserializer NetDataContractSerializer 其他信息 CVE ID: CVE-2025-66631 报告者: Outurnate 发布者: rockfordlhotka