External risk intelligence

DOXENSE WATCHDOC Untrusted Deserialization Vulnerability Enables Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-58384

The vulnerability exists in the administration interface of DOXENSE WATCHDOC. Administration interfaces for enterprise software and management platforms are commonly deployed with network accessibility to facilitate remote management, making them likely to be reachable in many deployment environments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in DOXENSE WATCHDOC's administration interface, allowing unauthenticated attackers to execute arbitrary code remotely by exploiting a deserialization flaw in the .NET Remoting library. This could potentially compromise the integrity and availability of systems running affected versions.

Untrusted data can lead to remote code execution.
Affects Watchdoc administration, a likely internet-facing component.
Confirm relevance and exposure for Watchdoc instances.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to the Watchdoc administration interface over the network. Because the application uses .NET Remoting and deserializes untrusted data, an attacker can trigger remote code execution. This could allow them to take control of the affected system.

No authentication required.
Deserializing untrusted data.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Deserialization of untrusted data in the Watchdoc administration interface could allow an unauthenticated attacker to execute arbitrary code remotely. This is possible through the .NET Remoting library, potentially impacting system integrity and availability.

System data and service behavior.
Untrusted data processed by the administration interface.
Remote code execution affecting service operation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for application security and infrastructure should prioritize investigating this vulnerability, as it allows for remote code execution via the Watchdoc administration interface. The first practical step is to identify all instances of DOXENSE WATCHDOC, confirm network reachability and business criticality, and then ascertain the accountable owner for remediation planning.

Application and Infrastructure teams own the issue.
Verify Watchdoc administrative interface exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DOXENSE WATCHDOC?

DOXENSE WATCHDOC is a print management and document processing software suite. Organizations use it to monitor, control, and account for print, scan, and copy activities across their enterprise network environments. The software typically includes an administration interface used by IT staff to configure these tracking features and manage connected devices.

What does CWE-502 mean for CVE-2025-58384?

CWE-502, or Deserialization of Untrusted Data, is the technical weakness exploited by this CVE. It occurs when an application takes data received from an outside source and converts it back into an object without sufficient validation. Because the system trusts this incoming information, an attacker can supply malicious instructions that the application unwittingly executes, leading to full system compromise.

How can an attacker trigger this vulnerability?

An attacker exploits this bug by sending specially crafted, malicious data to the software's administration interface using the .NET Remoting library. Because the interface accepts this data without requiring valid credentials, the attack can be initiated remotely. It is important to note that the vulnerability is specific to the handling of deserialized data and cannot be triggered by simply browsing public-facing print portals that do not utilize this specific administrative backend process.

Is my DOXENSE WATCHDOC instance at risk?

Halo Surface Signal indicates that this risk is likely because administration interfaces in enterprise software are often configured for remote access, increasing the chance they are reachable over a network. If your management console is accessible from outside your local network, or even across different segments of your internal network, it should be considered a potential target for unauthorized remote code execution.

What should I do if I run DOXENSE WATCHDOC?

Your first step is to locate all deployments of the software within your infrastructure to assess their configuration. Prioritize checking which instances have their administration interfaces exposed to network traffic. Once identified, document the business impact for each system and coordinate with your internal IT or application owners to plan for the necessary updates provided by the vendor.

References

doc.doxense.com/Watchdoc/J_Securite/cve-2025-58384.htm

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.