FNT Command Code Execution Vulnerability in C Base Module

A code execution vulnerability has been identified in FNT Command version 13.4.0, through the C Base Module. This issue allows authenticated users to upload malicious files that are not properly validated, which can then be executed on the server with the application's privileges.

Impact

Exploitation of this vulnerability allows for arbitrary file uploads that can be executed as operating system commands, leading to remote code execution on the FNT Command server. This could result in a full compromise of the affected instance, including unauthorized access to data, potential modification of that data, or further lateral movement within the server environment, depending on the privileges held.

Remediation

Users can upgrade to FNT Command version 13.4.1 or later, where this vulnerability has been fixed.