A critical security vulnerability has been discovered in Broadcom’s Symantec Endpoint Management Suite that enables unauthenticated remote code execution, posing significant risks to enterprise IT infrastructure.

The flaw, designated CVE-2025-5333 with a severe CVSS v4.0 score of 9.5, affects multiple versions of the widely-deployed endpoint management solution and has prompted immediate mitigation recommendations from security experts.

Key Takeaways
1. CVE-2025-5333 (CVSS 9.5) affects Symantec Endpoint Management Suite 8.6.x-8.8, enabling unauthenticated remote code execution via port 4011.
2. Insecure .NET object deserialization in Altiris IRM component allows attackers to execute arbitrary code through crafted payloads.
3. Block port 4011 on firewalls - this port is unnecessary for normal Symantec operations according to Broadcom documentation.
4. Discovered May 2025, confirmed by Broadcom PSIRT, with localhost-only restrictions planned for future releases.

Symantec Altiris RCE Vulnerability

The vulnerability resides in the Symantec Altiris Inventory Rule Management (IRM) component, specifically targeting an exposed legacy .NET Remoting endpoint at tcp://

The CVSS vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H indicates network-accessible exploitation requiring no user authentication or interaction.

The affected product versions include Symantec Endpoint Management Suite 8.6.x, 8.7.x, and 8.8 installations.

The vulnerability stems from insecure deserialization of .NET objects through the BinaryServerFormatterSinkProvider with TypeFilterLevel set to Full, a configuration that enables unrestricted object deserialization.

This allows attackers to craft malicious .NET objects that trigger arbitrary code execution when processed by the target server.

LRQA security researchers discovered the vulnerability during a Red Team assessment after identifying exposed processes on a hardened endpoint.

Using PowerShell enumeration commands, they located port 4011 bound to 0.0.0.0, indicating global network accessibility:

Analysis using DnSpy .NET debugger revealed the presence of RemotingConfiguration.RegisterWellKnownServiceType, confirming legacy .NET Remoting usage.

Researchers successfully demonstrated exploitation using James Forshaw’s ExploitRemotingService tool with the command: ExploitRemotingService.exe –uselease tcp://

Risk Factors	Details
Affected Products	Broadcom Symantec Endpoint Management Suite (Altiris) 8.6.x, 8.7.x, 8.8
Impact	Unauthenticated Remote Code Execution (RCE)
Exploit Prerequisites	– Network access to target system- Port 4011 accessible- No authentication required- No user interaction needed
CVSS v4.0 Score	9.5 (CRITICAL)

Broadcom’s PSIRT team responded promptly to the coordinated disclosure, confirming that port 4011 is not required for normal operations according to official documentation.

Primary mitigation involves ensuring firewalls block port 4011 on Notification Servers, effectively preventing remote exploitation.

Additional mitigation includes configuring the IRM_HostedServiceUrl core setting with an empty value and restarting the Altiris Inventory Rule Management Service.

Broadcom has committed to limiting .NET Remoting access to localhost-only in upcoming releases.

Organizations using affected versions should immediately verify firewall configurations and implement recommended security controls to prevent potential exploitation of this critical vulnerability.

Investigate live malware behavior, trace every step of an attack, and make faster, smarter security decisions -> Try ANY.RUN now

The post Symantec Endpoint Management Suite Vulnerability Allows Malicious Code Execution Remotely appeared first on Cyber Security News.