CVE-2016-6598 BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a method that allows uploading a file to an ar...
CriticalCVSS 9.8
EPSS 19.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a method that allows uploading a file to an arbitrary path on the machine that is running Track-It!. This can be used to upload a file to the web root and achieve code execution as NETWORK SERVICE or SYSTEM.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bmc track-it | <= 11.4 | No fix listed |
| bmc track-it | = 11.4-hf1 | No fix listed |
| bmc track-it | = 11.4-hf2 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20180126 [CVE-2016-6598/9]: RCE and admin cred disclosure in BMC Track-It! 11.4 exploit mailing-list technical-description third-party-advisory
- communities.bmc.com vendor-advisory
- github.com exploit third-party-advisory