Deserialization of untrusted data in OpenText RightFax .NET Remoting (CVE-2025-15610)

The .NET Remoting framework used by OpenText RightFax (Windows) contains a deserialization of untrusted data vulnerability enabling object injection. Unauthenticated remote attackers with access to the remoting ports can perform arbitrary file read/write operations, execute remote code, and conduct SMB coercion. The vulnerability is exposed via network-accessible ports 34001 and 34002. Affected versions: - Fax 1.0 - Fax 1.0.1 - Fax 1.1 - Fax 1.2 - Fax 1.3 - Fax 1.4.2.11 - Fax 1.4.2.14 - Fax 1.4.2.16 - Fax 1.4.2.17 - Fax 1.4.2.24 - Fax 1.5.0.1.3 - Fax 1.5.0.3 - Fax 1.5.0.5 - Fax 1.7.3 - Fax 1.8.2 - Fax 1.8.3 - Fax 10.0 - Fax 10.0.0 - Fax 10.0.0 SR2 - Fax 10.0.0 SR3 - Fax 10.0.0 SR4 - Fax 10.5 - Fax 10.5 FP1 - Fax 10.5 FP1 SR1 - Fax 10.5 FP1 SR2 - Fax 10.5 FP1 SR3 - Fax 10.5 FP1 SR4 - Fax 10.5 FP1 SR5 - Fax 10.6 - Fax 10.6 FP1 - Fax 10.6 FP1 SR3 - Fax 10.6 FP2 - Fax 10.6 FP2 SR1 - Fax 10.6 FP2 SR2 - Fax 10.6 FP2 SR3 - Fax 10.6 FP2 SR4 - Fax 10.6 FP3 - Fax 10.6 FP3 SR1 - Fax 10.6 FP3 SR3 - Fax 10.6 FP3 SR4 - Fax 10.6 FP3 SR5 - Fax 10.6 FP3 SR6 - Fax 10.6 FP3 SR7 - Fax 16.1 - Fax 16.2 - Fax 16.2 SR1 - Fax 16.2 SR2 - Fax 16.2 SR3 - Fax 16.2 SR4 - Fax 16.2 SR5 - Fax 16.2 SR6 - Fax 16.2 SR7 - Fax 16.2 SR8 - Fax 16.4 - Fax 16.4 SR1 - Fax 16.4 SR2 - Fax 16.4 SR3 - Fax 16.4 SR5 - Fax 16.4 SR6 - Fax 16.6 - Fax 16.6 SR1 - Fax 16.6 SR2 - Fax 16.6 SR3 - Fax 16.6 SR4 - Fax 16.6 SR5 - Fax 2.0 - Fax 2.0.0.3 - Fax 2.0.6 - Fax 2.1 - Fax 2.1.0 - Fax 2.1.2 - Fax 2.1.5 - Fax 2.2 - Fax 2.3 - Fax 2.4 - Fax 2.5 - Fax 2.6 - Fax 2.7 - Fax 2.8 - Fax 20.2 - Fax 20.2 SR1 - Fax 20.2 SR2 - Fax 21.2 - Fax 22.2 - Fax 23.4 - Fax 24.4 - Fax 25.4 - Fax 3.0 - Fax 7.0 - Fax 7.0.0 - Fax 9.0 - Fax 9.0.1 - Fax 9.3 - Fax 9.3 FP2 - Fax 9.3 FP2 SR6 - Fax 9.4 - Fax 9.4 FP1 - Fax 9.4 FP1 SR1 - Fax 9.4 FP1 SR2 - Fax 9.4 FP1 SR3 - Fax 9.4 FP1 SR4 - Fax 9.4 SR1 - Fax 9.4 SR2 - Fax 9.4 SR3 - Fax 9.4 SR4 - Fax 9.4 SR5 We recommend updating to: Fax 21.2 Server, Fax 21.2 Client, Fax 22.2 Server, Fax 22.2 Client, Fax 23.4 Server, Fax 23.4 Client, Fax 24.4 Server, Fax 24.4 Client, Fax 25.4 Server, Fax 25.4 Client. CVSS 9.3 · our assessment: act_now Reference: https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0861863 Details: https://vuln.today/cve/CVE-2025-15610