Logo
HIGHFIXEDCVE-2021-26701CVE-2022-41089CVE-2022-38013 +5 CVEsSTC-2026-001

Multiple Vulnerabilities Mitigated by .NET Core 3.1 to .NET 10 Migration in PCFactory

Multiple known vulnerabilities in .NET Core 3.1 runtime have been mitigated by upgrading the PCFactory product to .NET 10. The deprecated .NET Core 3.1 framework (end-of-life December 2022) contained critical remote code execution, denial of service, information disclosure, and security bypass vulnerabilities that are no longer present in .NET 10.

Published

August 25, 2026

Updated

August 25, 2026

CVSS Score

8.1/10

Affected Products

PCFactory

Affected: All PCFactory versions running .NET Core 3.1 (PCFactory < 4.4)

Fixed in Versions migrated to .NET 10 - PCFactory >= 4.4

Summary

The PCFactory product was running on .NET Core 3.1, a framework that reached end-of-life on December 13, 2022. Since that date, no security patches have been released for .NET Core 3.1, leaving the application exposed to multiple known vulnerabilities. As part of a proactive security hardening initiative, PCFactory has been migrated to .NET 10, which addresses all identified vulnerabilities and restores active security support.

Vulnerabilities Mitigated

CVETypeSeverityCVSSDescription
CVE-2021-26701Remote Code ExecutionCritical8.1RCE in System.Text.Encodings.Web allowing arbitrary code execution without user interaction or authentication.
CVE-2022-41089Remote Code ExecutionHigh7.8RCE via parsing of maliciously crafted XPS files causing arbitrary code execution.
CVE-2022-38013Denial of ServiceHigh7.5Stack overflow via ModelStateDictionary recursion during model binding, crashing the application.
CVE-2022-24512Remote Code ExecutionMedium6.3RCE allowing code execution in the context of the current user through specially crafted input.
CVE-2022-24464Denial of ServiceHigh7.5Excessive resource consumption caused by specially crafted HTTP requests in ASP.NET Core.
CVE-2022-34716Information DisclosureMedium5.9Unauthorized access to privileged information through cryptographic weaknesses in XML signature verification.
CVE-2020-1045Security Feature BypassMedium7.5Cookie parser flaw allowing attackers to bypass cookie prefix security mechanisms via percent-encoded names.
CVE-2020-1597Denial of ServiceHigh7.5Improper handling of web requests allowing unauthenticated remote attackers to cause excessive resource consumption.

Impact

PCFactory instances running on .NET Core 3.1 were potentially exposed to:

  • Remote Code Execution: Attackers could execute arbitrary code on the server without authentication.
  • Denial of Service: The application could be crashed or made unresponsive through crafted HTTP requests.
  • Information Disclosure: Sensitive data could be exposed through cryptographic weaknesses.
  • Security Bypass: Authentication and cookie-based security mechanisms could be circumvented.

Remediation

The PCFactory product has been upgraded from .NET Core 3.1 to .NET 10. This migration addresses all listed CVEs and ensures the product benefits from:

  • Active security patching and Long-Term Support (LTS)
  • Modern security features including improved cryptographic libraries
  • Enhanced input validation and request handling
  • Hardened runtime with mitigations against known attack classes

Action required: Customers should update PCFactory to the latest version that runs on .NET 10. Previous versions running .NET Core 3.1 should be considered vulnerable and must be replaced.

Advisory Details

Advisory ID

STC-2026-001

CVE (8)

CVE-2021-26701
CVE-2022-41089
CVE-2022-38013
CVE-2022-24512
CVE-2022-24464
CVE-2022-34716
CVE-2020-1045
CVE-2020-1597

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

dotnetruntime-upgraderemote-code-executiondenial-of-serviceinformation-disclosureend-of-lifepcfactory

Disclosure Timeline

June 14, 2026
Internal security assessment initiated
June 30, 2026
Migration to .NET 10 completed
July 9, 2026
Validation and regression testing concluded
July 31, 2026
Updated PCFactory version released to customers
August 25, 2026
Public advisory disclosure