CVE-2024-44598
📋 TL;DR
FNT Command 13.4.0 contains a vulnerability in its C Base Module that allows remote code execution. Attackers can upload malicious files to execute arbitrary code on affected systems. Organizations using FNT Command 13.4.0 for infrastructure management are affected.
💻 Affected Systems
- FNT Command
📦 What is this software?
Fnt Command by Fntsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal sensitive data, deploy ransomware, or pivot to other network systems.
Likely Case
Attackers gain initial foothold on the server, install backdoors, exfiltrate configuration data, and potentially compromise connected infrastructure management systems.
If Mitigated
Attack is blocked at network perimeter or detected before code execution, limiting impact to failed exploitation attempts.
🎯 Exploit Status
Proof of concept available on GitHub demonstrates file upload leading to code execution. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://fnt.com
Restart Required: No
Instructions:
1. Contact FNT Software for patch availability 2. Apply vendor-provided patch 3. Verify patch installation 4. Restart services if required
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to FNT Command to trusted networks only
Web Application Firewall Rules
allBlock file upload requests to C Base Module endpoints
🧯 If You Can't Patch
- Isolate FNT Command server from internet and restrict internal access
- Implement strict file upload validation and monitoring for the C Base Module
🔍 How to Verify
Check if Vulnerable:
Check FNT Command version via web interface or configuration files. Version 13.4.0 is vulnerable.Check Version:
Check web interface or consult FNT Command documentation for version check procedureVerify Fix Applied:
Verify version is updated beyond 13.4.0 or test file upload functionality to C Base Module endpoints.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to C Base Module endpoints
- Suspicious process execution from web server context
- Unexpected network connections from FNT Command server
Network Indicators:
- HTTP POST requests to C Base Module file upload endpoints
- Outbound connections from FNT Command server to unknown external IPs
SIEM Query:
source="fnt-command" AND (url="*c-base*" AND method="POST") OR process="cmd.exe" OR process="powershell.exe"