InternLM LMDeploy EUVD-2025-210921

Requires the victim to run LMDeploy 0.9.1-0.10.1 with the AsyncRPCServer (zmq_rpc.py) RPC service started AND reachable from the attacker's network position - the server performs no IP-source validation and no authentication on the ZMQ channel, and call_and_response() calls pickle.loads() on raw received bytes. Limiting factors: the RPC listening port is randomized, so the attacker must port-scan to locate it (no other credential or user interaction is needed); and if the deployment already confines the RPC socket to localhost/loopback or a trusted host, remote exploitation is not possible. Upgrading to 0.10.2 both patches deserialization exposure and binds the RPC to localhost only.

This is a genuine high-priority vulnerability, not a paper-tiger high CVSS. The vendor CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is well-justified: CWE-502 unsafe pickle.loads() on attacker-supplied ZMQ RPC messages yields unauthenticated remote code execution, and the GHSA advisory contains a concrete working proof-of-concept (reverse shell to 202.112.47.27:4444), so publicly available exploit code exists. Two signals temper the raw score without contradicting it: (1) the fix commit is PR #4017 'zmqrpc localhost only', confirming the intended mitigation is to bind the RPC socket to loopback - meaning exploitability hinges on the server being reachable on a routable interface, which the advisory says was the pre-patch behavior since the server 'does not validate the connecting IP'; (2) the advisory itself notes the RPC port is randomized, so an attacker must port-scan to locate the service - a discovery hurdle, not a true CVSS access-complexity increase. No CISA KEV listing and no EPSS score are provided, so there is no evidence of active in-the-wild exploitation despite the public PoC - consistent with a niche LLM-serving toolkit rather than a mass-exploited target. Net: treat as urgent-patch for any exposed LMDeploy 0.9.1-0.10.1 RPC deployment; lower urgency if the RPC socket is already confined to localhost or a trusted network segment.

A victim runs LMDeploy (0.9.1-0.10.1) with the AsyncRPCServer listening on a network-reachable interface. An attacker scans for the randomized RPC port, connects (the server never validates the source IP), and sends a malicious pickle payload that call_and_response() deserializes via pickle.loads(), executing an embedded __reduce__ os.system reverse-shell command and granting the attacker a shell on the victim host. A complete working PoC is published in the GHSA advisory, so no exploit development is required.