BaseFortify

Executive Summary

CVE-2026-63079 is an unauthenticated deserialization vulnerability in RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0. The flaw exists in the deprecated .NET Remoting service exposed on TCP port 2001 via AxcvcLt.dll. It uses BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without authentication. Attackers can send malicious serialized payloads to the IntegraURI object endpoint to achieve remote code execution as NT AUTHORITY\SYSTEM.

Useful 0 Not Useful 0

Detection Guidance

• Scan TCP port 2001 on systems running Integra32 to check if the .NET Remoting service is exposed. Use nmap with: nmap -p 2001 -sV <target_IP>.
• Check for the presence of AxcvcLt.dll in the Integra32 installation directory, which indicates the vulnerable .NET Remoting service.
• Monitor network traffic for suspicious serialized payloads sent to port 2001, particularly BinaryFormatter data.
• Use ysoserial.net to test for deserialization flaws by generating test payloads and attempting to send them to the IntegraURI endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges on the host running Integra32. They can fully compromise the system, perform arbitrary file read/write operations, and coerce SMB/NTLMv2 credentials. This leads to complete control over the affected Windows system where Integra32 is installed.

Useful 0 Not Useful 0

Mitigation Strategies

• Disable the .NET Remoting service on TCP port 2001 immediately by stopping the Integra32 service or blocking port 2001 in the firewall.
• Upgrade Integra32 to the latest version if an update is available that patches this vulnerability.
• Restrict network access to port 2001 to trusted IPs only using network segmentation or host-based firewalls.
• Monitor for signs of exploitation, such as unauthorized file writes or unusual processes running as NT AUTHORITY\SYSTEM.

Useful 0 Not Useful 0