This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), exists in the INFINITUM FORM Geo Controller product through version 8.6.4. It allows an attacker to supply maliciously crafted serialized data that the application deserializes insecurely, potentially leading to remote code execution or other critical impacts. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary code remotely, fully compromise the affected system's confidentiality, integrity, and availability. This represents a critical security risk to systems running vulnerable versions of the Geo Controller.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider mitigating exposure by restricting network access to the Geo Controller and monitoring for suspicious activity related to deserialization inputs.