CVE-2018-7756 RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which al
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2018-7756?
CVE-2018-7756 is a critical vulnerability in n/a, published on 14 Mar 2018.
Official description
RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which allows remote attackers to execute arbitrary code or access internal commands, as demonstrated by a RUN command that launches a .EXE file located at an arbitrary external URL, or a "SETFIREWALL Off" command.
Weakness: CWE-94
Which versions are affected by CVE-2018-7756?
It affects 1 product.
Products include Dewesoft Dewesoft.
How do I fix CVE-2018-7756?
No fix has been published for CVE-2018-7756 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-7756 being exploited?
There is no known exploitation of CVE-2018-7756 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-4xp9-4pw5-f225.