Camera Station CVE-2025-30023

The CVSS 9.0 score with vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects significant real-world risk: (1) Attack Vector Adjacent means attacker must be on the same network segment, reducing opportunistic exploitation but common in enterprise environments; (2) Low Complexity and no User Interaction requirement indicate exploitation is straightforward once network access is gained; (3) Privileged access requirement (PR:L) provides partial mitigation—not unauthenticated—but compromised or insider accounts present realistic threats; (4) Scope Change (S:C) with High impact across all three dimensions (CIA) confirms this can compromise systems beyond the immediate target. The authenticated requirement moderately reduces but does not eliminate real-world risk, particularly in compromised credential scenarios or insider threats. If KEV (Known Exploited Vulnerability) status confirms active exploitation or public POC exists, exploitation probability is HIGH and should trigger immediate remediation regardless of network positioning assumptions.

An attacker with valid credentials (e.g., compromised employee account, insider, or authenticated partner system) on the same network segment connects to the vulnerable server using the affected client-server protocol. The attacker crafts a malicious serialized object—likely exploiting gadget chains in common libraries (e.g., commons-collections in Java)—and sends it through the authenticated channel. The server deserializes the untrusted data without validation, instantiating malicious classes that execute arbitrary code with server privileges. The attacker gains remote code execution, allowing data exfiltration, lateral movement, or system compromise. No user interaction is required; the attack succeeds automatically upon deserialization. If public POC code exists, this scenario becomes reproducible by lower-skill attackers, significantly increasing real-world exploitation likelihood.