This vulnerability (CWE-502) in Broadcom Layer 7 API Gateway 11.2.1 allows an attacker with the ability to intercept and modify traffic between the client and the API Gateway server to cause the server to deserialize arbitrary objects. Deserialization of untrusted data can lead to security breaches such as remote code execution or other violations of security assumptions. The CVSS 4.0 base score is 5.3, indicating a medium severity level. There is no vendor advisory or patch information available, and the product is not a cloud service. No known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary code remotely or cause other security violations by manipulating deserialized objects. This compromises the integrity and security of the API Gateway server and potentially the applications relying on it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, organizations should monitor vendor communications for updates and consider restricting network access to the API Gateway to trusted sources to reduce the risk of interception and tampering.