A critical deserialization vulnerability in Mescius ActiveReports.NET poses a severe risk of full system compromise via remote code execution.

This vulnerability involves the insecure deserialization of untrusted data within the ReadValue function, allowing an unauthenticated remote attacker to execute arbitrary code with the privileges of the application process.

Successful exploitation of this flaw allows an attacker to execute arbitrary commands, potentially leading to a complete system takeover. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it requires no user interaction and no authentication, making it highly attractive for automated exploitation.

Immediate Action: Update Mescius ActiveReports.NET to the latest available version as specified by the vendor to remove the insecure deserialization capability.

Proactive Monitoring: Monitor server logs for unusual inbound traffic patterns, particularly those originating from untrusted sources targeting the application’s deserialization endpoints.

Compensating Controls: Deploy Web Application Firewall (WAF) rules designed to inspect and filter serialized data streams to prevent the injection of malicious objects.

Public Exploit Available: No (unknown)

The severity of this vulnerability cannot be overstated; the ability for an unauthenticated attacker to execute code remotely necessitates immediate action. Administrators must verify their current version of ActiveReports.NET and apply the vendor-provided patch without delay to prevent potential system compromise.