Apr 2025
Description

FNT Command before 13.4.1 is affected by an authenticated arbitrary file upload vulnerability that can be abused to execute operating-system commands with the privileges of the application. The issue arises because uploaded files are insufficiently validated, allowing an attacker to upload and run malicious payloads.

Details

  • Product: FNT Command
  • Affected Versions: <= 13.4.0
  • Vulnerability Type: CWE-434: Unrestricted Upload of File with Dangerous Type
  • Risk Level: High - CVSS 3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
  • Authentication: Required
  • Vendor URL: https://www.fntsoftware.com/
  • Vendor acknowledged vulnerability: Yes
  • Vendor Status: Fixed
  • CVE: CVE-2024-44598

Impact

A successful attacker can upload a crafted file and trigger its execution, resulting in remote code execution on the FNT Command server. This can lead to full compromise of the affected FNT Command instance, including data access, modification, or further lateral movement depending on server privileges.

References

Timeline

  • 2024-09: Vulnerability reported to the vendor.
  • 2024-10: Vendor published a fix for the issue.
  • 2025-04: Information about the vulnerability is published.

Credits

Zurück zum Blog | Advisories