Description
The ASP.NET application is using a weak or publicly known validation key to generate the Message Authentication Code (MAC) for ViewState. This exposes the application to ViewState tampering attacks. Due to the nature of ViewState, an attacker can exploit this weakness to perform a deserialization attack and potentially gain control over the application.
It is very important that the validation key remains secret. In this case, your application is using a weak or known validation key, and the scanner was able to successfully guess it.
Remediation
Use auto-generated validation keys by setting "AutoGenerate" in the web.config file. Alternatively, configure a long, cryptographically secure random validation key.
References
machineKey Element (ASP.NET Settings Schema)
Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net