Mescius ActiveReports.NET is vulnerable to remote code execution due to insecure deserialization, which could allow an unauthenticated attacker to take full control of the host server.

This is a deserialization of untrusted data vulnerability (CWE-502) located within the TypeResolutionService, which can be exploited by an unauthenticated attacker to achieve remote code execution.

With a CVSS score of 9.8, this vulnerability is critical as it allows for full system compromise. An attacker capable of exploiting this flaw can execute arbitrary commands with the privileges of the application, leading to total data loss, unauthorized access, or the deployment of ransomware within the environment.

Immediate Action: Update Mescius ActiveReports.NET to the latest version provided by the vendor to address the insecure deserialization flaw.

Proactive Monitoring: Review system logs for unusual process execution or child processes spawned by the web application service.

Compensating Controls: If immediate patching is not possible, restrict network access to the affected service and utilize endpoint detection and response (EDR) tools to identify and block suspicious command execution.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to any system running the affected version of ActiveReports.NET. Organizations must prioritize applying the vendor-supplied update to prevent potential remote code execution and full system compromise.