CVE-2024-35249: 
vulnerability analysis and mitigation

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability (CVE-2024-35249) affects multiple versions of Microsoft Dynamics 365 Business Central, including 2023 Release Wave 1 and 2024 Release Wave 1. The vulnerability was disclosed in June 2024 and impacts the core functionality of the Business Central platform (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The technical analysis indicates this is a deserialization of untrusted data vulnerability (CWE-502) that could potentially lead to remote code execution (NVD).

The vulnerability could allow an attacker to execute remote code on affected systems, potentially compromising the confidentiality, integrity, and availability of the Business Central environment. The high CVSS score indicates significant potential impact across all three security metrics (NVD).

The vulnerability requires low attack complexity and low privileges to exploit, with no user interaction needed, as indicated by the CVSS vector. The network vector (AV:N) suggests the vulnerability is exploitable remotely (NVD).

Microsoft has released security updates to address this vulnerability in multiple versions of Dynamics 365 Business Central. Updates are available for both 2023 Release Wave 1 (Update 22.13) and 2024 Release Wave 1 (Update 24.1). Organizations are advised to install the latest updates to mitigate this vulnerability (Microsoft Support).