| Action | Urgency | Description | |--------|---------|-------------| | | Critical | Move from Build 6919 or any build < 6985 to a supported, patched build. The minimum safe build for the original deserialization vulnerability is Build 6985 (August 2019). | | Block port 17001 | High | If upgrading is not immediately possible, block TCP port 17001 at the firewall for all external access. However, this is only a temporary measure—remote exploitation may still be possible via HTTP endpoints. | | Disable .NET remoting endpoints | Medium | If the server cannot be upgraded, restrict the .NET remoting service to localhost only (127.0.0.1) to prevent remote attacks. | | Check for compromise | Critical | Assume Build 6919 systems may already be compromised. Review logs for unexpected process executions, new ASPX files in web directories, and unusual outbound connections. |
Even patched, implement additional defenses: