iBaPDA/iBaDatCoordinator .NET BinaryFormatter Deserialization Vulnerability (CWE-502)

Vulnerability Overview Vulnerability Name: Deserialization Vulnerability in iBaPDA and iBaDatCoordinator Vulnerability Description: A deserialization vulnerability has been identified in iBaPDA and iBaDatCoordinator. The affected software does not properly restrict .NET BinaryFormatter when deserializing client input. This may allow attackers to trigger type confusion and execute arbitrary code within the affected software. This is the same vulnerability known in .NET BinaryFormatter. CVSS Score: 9.8 (Critical) CWE Identifier: CWE-502 (Deserialization of Untrusted Data) Affected Products Affected Products: - iBaPDA <8.14.0 - iBaPDA 8.14.0 - iBaDatCoordinator <4.0.7 - iBaDatCoordinator 4.0.7 Remediation Mitigation: - Restrict connections to localhost. - In iBaPDA, navigate to I/O Manager - General and disable the option "Automatically open necessary ports in Windows Firewall". If this option remains enabled, the firewall will automatically reconfigure itself after iBaPDA client and server restarts. - Create manual firewall rules for iBaPDA and iBaDatCoordinator and verify that you have the correct port configuration. - After making changes, verify that all iBaPDA or iBaDatCoordinator services are functioning correctly and that data acquisition operations are normal. Fixed Versions: - iBaPDA v8.14.0 - iBaDatCoordinator v4.0.7 References CERTWOE Security Advisory CVE-2026-051 CSAF Advisory

Goal Reached Thanks to every supporter — we hit 100%!

iBaPDA/iBaDatCoordinator .NET BinaryFormatter Deserialization Vulnerability (CWE-502)