critical9.8Public exploit code
CVE-2018-7756
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which allows remote attacke…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- DEWESoft X3 SP1 (x64) - Remote Command Execution2018-03-12 · remote · windows_x86-64
Impact
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which allows remote attackers to execute arbitrary code or access internal commands, as demonstrated by a RUN command that launches a .EXE file located at an arbitrary external URL, or a "SETFIREWALL Off" command.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dewesoft | Dewesoft | Version x3 |