Multiple Vulnerabilities Mitigated by .NET Core 3.1 to .NET 10 Migration in PCFactory
Multiple known vulnerabilities in .NET Core 3.1 runtime have been mitigated by upgrading the PCFactory product to .NET 10. The deprecated .NET Core 3.1 framework (end-of-life December 2022) contained critical remote code execution, denial of service, information disclosure, and security bypass vulnerabilities that are no longer present in .NET 10.
Published
August 25, 2026
Updated
August 25, 2026
CVSS Score
8.1/10
Affected Products
PCFactory
Affected: All PCFactory versions running .NET Core 3.1 (PCFactory < 4.4)
Associated Vulnerabilities
8/8Summary
The PCFactory product was running on .NET Core 3.1, a framework that reached end-of-life on December 13, 2022. Since that date, no security patches have been released for .NET Core 3.1, leaving the application exposed to multiple known vulnerabilities. As part of a proactive security hardening initiative, PCFactory has been migrated to .NET 10, which addresses all identified vulnerabilities and restores active security support.
Vulnerabilities Mitigated
| CVE | Type | Severity | CVSS | Description |
|---|---|---|---|---|
| CVE-2021-26701 | Remote Code Execution | Critical | 8.1 | RCE in System.Text.Encodings.Web allowing arbitrary code execution without user interaction or authentication. |
| CVE-2022-41089 | Remote Code Execution | High | 7.8 | RCE via parsing of maliciously crafted XPS files causing arbitrary code execution. |
| CVE-2022-38013 | Denial of Service | High | 7.5 | Stack overflow via ModelStateDictionary recursion during model binding, crashing the application. |
| CVE-2022-24512 | Remote Code Execution | Medium | 6.3 | RCE allowing code execution in the context of the current user through specially crafted input. |
| CVE-2022-24464 | Denial of Service | High | 7.5 | Excessive resource consumption caused by specially crafted HTTP requests in ASP.NET Core. |
| CVE-2022-34716 | Information Disclosure | Medium | 5.9 | Unauthorized access to privileged information through cryptographic weaknesses in XML signature verification. |
| CVE-2020-1045 | Security Feature Bypass | Medium | 7.5 | Cookie parser flaw allowing attackers to bypass cookie prefix security mechanisms via percent-encoded names. |
| CVE-2020-1597 | Denial of Service | High | 7.5 | Improper handling of web requests allowing unauthenticated remote attackers to cause excessive resource consumption. |
Impact
PCFactory instances running on .NET Core 3.1 were potentially exposed to:
- Remote Code Execution: Attackers could execute arbitrary code on the server without authentication.
- Denial of Service: The application could be crashed or made unresponsive through crafted HTTP requests.
- Information Disclosure: Sensitive data could be exposed through cryptographic weaknesses.
- Security Bypass: Authentication and cookie-based security mechanisms could be circumvented.
Remediation
The PCFactory product has been upgraded from .NET Core 3.1 to .NET 10. This migration addresses all listed CVEs and ensures the product benefits from:
- Active security patching and Long-Term Support (LTS)
- Modern security features including improved cryptographic libraries
- Enhanced input validation and request handling
- Hardened runtime with mitigations against known attack classes
Action required: Customers should update PCFactory to the latest version that runs on .NET 10. Previous versions running .NET Core 3.1 should be considered vulnerable and must be replaced.
Advisory Details
Advisory ID
STC-2026-001
CVE (8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Tags