CVE-2023-24078

What it actually does

Real Time Logic FuguHub 8.1 and earlier contains a remote code execution vulnerability in the /FuguHub/cmsdocs/ component. The CVSS vector indicates network exploitation with low attack complexity, no user interaction, and low privileges required, leading to high confidentiality, integrity, and availability impact. In practical terms, an authenticated or otherwise low-privileged attacker who can reach the FuguHub web interface may be able to cause the server to execute attacker-controlled code in the context of the FuguHub process or underlying web service account.

Why it matters to the business

Successful exploitation can give an attacker control over the FuguHub server, allowing theft or alteration of hosted content, credential exposure, deployment of malware, lateral movement, or service disruption. Because public exploit code is available and the EPSS score is elevated, internet-exposed FuguHub instances should be treated as high-priority remediation targets even though the vulnerability is not currently listed in CISA KEV. Organizations using FuguHub for file sharing, web hosting, collaboration, or embedded web services may face operational outages, data compromise, and reputational impact if exposed systems are exploited.

How an attack unfolds

An attacker first identifies a reachable FuguHub instance, commonly by scanning for the FuguHub web interface and paths under /FuguHub/. They then obtain or use low-privileged access if authentication is enforced, and target the vulnerable /FuguHub/cmsdocs/ component with a crafted request designed to trigger command or code execution. If successful, the attacker’s payload runs on the server with the privileges of the FuguHub process. The attacker may then verify execution using outbound callbacks, create or modify files in web-accessible directories, add persistence, harvest configuration files or credentials, and use the compromised host for further access or disruption.

How to fix it

Upgrade Real Time Logic FuguHub to a vendor-supported version newer than 8.1 if available from the vendor, and remove or replace unsupported deployments. Because no fixed version was provided in the supplied data, administrators should consult Real Time Logic advisories and release notes for the first non-vulnerable release. Until upgraded, restrict access to the FuguHub administrative and CMS interfaces, especially /FuguHub/cmsdocs/, by placing the service behind a VPN, firewall, reverse proxy allowlist, or other access-control layer. Disable unnecessary CMS/documentation functionality if possible, enforce strong authentication, rotate credentials that may have been exposed, run the service with least privilege, and monitor for suspicious file writes or process execution by the FuguHub service account.

How to confirm the fix worked

Confirm the deployed FuguHub version is newer than 8.1 or otherwise confirmed by the vendor as not affected. Verify that internet-facing access to /FuguHub/cmsdocs/ is blocked or limited to trusted sources unless the system has been upgraded. Perform a configuration review to ensure the FuguHub process runs with minimal privileges and cannot write to sensitive operating system locations. Use vulnerability scanning or a safe, non-destructive check to fingerprint the FuguHub version and verify that the vulnerable endpoint no longer accepts requests from untrusted networks. Review web server, application, and operating system logs after remediation to ensure no suspicious requests or post-exploitation artifacts remain.

Typical attack path

1. Scan the internet or internal network for exposed Real Time Logic FuguHub instances.
2. Fingerprint the application version or confirm the presence of FuguHub 8.1 or earlier.
3. Authenticate with low-privileged credentials if required by the deployment.
4. Send a crafted request to the vulnerable /FuguHub/cmsdocs/ component.
5. Execute a command or payload under the FuguHub service context.
6. Establish a callback, web shell, new user, scheduled task, or other persistence mechanism.
7. Collect application data, credentials, hosted files, or configuration material.
8. Move laterally, stage additional tooling, deface content, or disrupt the service.

How to detect it

Review FuguHub application logs, web access logs, reverse proxy logs, endpoint telemetry, process creation logs, file integrity monitoring, authentication logs, and outbound network logs for activity targeting /FuguHub/cmsdocs/. Focus on unusual HTTP methods, encoded payloads, shell metacharacters, command names, traversal sequences, unexpected file uploads, and requests followed by new processes spawned by the FuguHub service. On Linux or Unix-like systems, look for web-service-spawned shells such as sh, bash, curl, wget, python, perl, nc, or chmod. On Windows, look for cmd.exe, powershell.exe, wscript.exe, certutil.exe, bitsadmin.exe, rundll32.exe, or mshta.exe launched by the FuguHub process or web service. Investigate newly created executable files, scripts, web shells, modified CMS content, suspicious scheduled tasks, new users, and outbound connections to unfamiliar IP addresses soon after requests to the vulnerable path. Because public exploits are available, review historical logs back to at least the publication date where feasible, or as far as retention allows.

• /FuguHub/cmsdocs/
• GET /FuguHub/cmsdocs/
• POST /FuguHub/cmsdocs/
• /FuguHub/cmsdocs/..
• /FuguHub/cmsdocs/%2e%2e
• /FuguHub/cmsdocs/%252e%252e
• /FuguHub/cmsdocs/;
• /FuguHub/cmsdocs/%3b
• /FuguHub/cmsdocs/|
• /FuguHub/cmsdocs/%7c
• /FuguHub/cmsdocs/`
• /FuguHub/cmsdocs/%60
• /FuguHub/cmsdocs/$(
• /FuguHub/cmsdocs/%24%28
• cmd.exe
• powershell.exe
• /bin/sh
• /bin/bash
• curl
• wget
• nc
• netcat
• chmod +x
• python -c
• perl -e
• certutil.exe
• bitsadmin.exe
• mshta.exe

What your security team should do

• Inventory all Real Time Logic FuguHub deployments, including externally exposed and embedded instances.
• Prioritize remediation for any FuguHub 8.1 or earlier instance reachable from the internet or untrusted networks.
• Upgrade to a vendor-supported non-vulnerable release; if no suitable fixed release is available, isolate or decommission the service.
• Immediately restrict access to /FuguHub/cmsdocs/ and administrative FuguHub paths using network controls.
• Review logs for historical exploitation attempts and successful post-exploitation activity, especially because exploit code is publicly available and EPSS is elevated.
• Rotate credentials stored on or used by affected FuguHub systems if compromise cannot be ruled out.
• Hunt for unexpected child processes, new files, web shells, scheduled tasks, or new local accounts created around suspicious web requests.
• Add SIEM detections for requests to /FuguHub/cmsdocs/ paired with command-execution patterns, unusual status codes, or outbound network callbacks.