Executive brief
SMSGate sms-core is a library used for processing SMS messages via the CMPP protocol. A security vulnerability in this component allows a remote attacker to execute malicious code on the server by sending a specially crafted message. This could lead to a complete system takeover, unauthorized access to sensitive data, or disruption of messaging services.
Technical details
An insecure deserialization vulnerability exists in SMSGate sms-core <= 2.1.13.6 within the Cmpp7FDeliverRequestMessageCodec.java component. The root cause is the use of the FST (Fast Serialization) library to deserialize untrusted data from CMPP 7F deliver request messages without proper validation or whitelisting. A remote, unauthenticated attacker can exploit this by sending a crafted CMPP message containing a malicious serialized object. Successful exploitation allows for arbitrary code execution in the context of the application. Remediation includes implementing an FST class whitelist or migrating to a safer serialization format like JSON.
Affected products
- SMSGate sms-core <= 2.1.13.6
Timeline
- 2026-05-28: disclosed: Initial disclosure and NVD publication