Themeton Zuut versions through 1.4.2 are affected by a CWE-502 deserialization of untrusted data vulnerability that permits object injection attacks. This vulnerability allows an attacker to send crafted serialized data to the application, potentially leading to remote code execution or other severe impacts. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code, compromise data confidentiality and integrity, and cause denial of service. The critical CVSS score (9.8) indicates a high likelihood of severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected application and monitor for unusual activity related to deserialization processes. Avoid accepting serialized objects from untrusted sources.