CVE-2018-7756

What it actually does

Unauthenticated access to RunExeFile.exe over TCP port 1999 permits remote issuance of commands including RUN to fetch and execute arbitrary executables from external URLs and commands such as SETFIREWALL Off.

Why it matters to the business

Attackers can gain full remote control of affected systems, execute malicious code, and disable protective controls, leading to complete system compromise and potential lateral movement.

How an attack unfolds

An attacker connects directly to TCP port 1999 on a system running the vulnerable installer component, issues a RUN command referencing a malicious executable hosted at an attacker-controlled URL, and the target executes the payload without any authentication or validation.

How to fix it

Upgrade to a current version of DEWESoft software that removes or properly secures the RunExeFile.exe listener; if an upgrade is unavailable, block inbound access to TCP port 1999 at the network perimeter and host firewall.

How to confirm the fix worked

Verify that TCP port 1999 is no longer listening or requires authentication; attempt to connect and issue commands to confirm rejection; review software version against vendor release notes.

Typical attack path

1. Discover hosts exposing TCP port 1999
2. Establish unauthenticated TCP connection to the port
3. Send RUN command with attacker-supplied executable URL
4. Payload executes on the target system
5. Optional follow-on commands such as SETFIREWALL Off to weaken defenses

How to detect it

Inspect firewall and host logs for inbound connections to TCP port 1999; search process execution logs and command history for strings containing RUN followed by a URL or SETFIREWALL Off.

• TCP port 1999 connection without credentials
• RUN command with external URL
• SETFIREWALL Off
• RunExeFile.exe process

What your security team should do

• Immediately block inbound traffic to TCP port 1999
• Identify all instances of DEWESoft X3 SP1 and schedule urgent upgrades
• Monitor network logs for connections to port 1999 and command strings such as RUN or SETFIREWALL
• Apply compensating network segmentation controls until remediation is complete