[0day-rubbish] South River Technologies Titan MFT Server 26.0.0 first-run administrator setup chained to job post-command injection, NT AUTHORITY\SYSTEM (8.1)
Researchers disclosed a Titan MFT 26.0.0 setup flaw chaining to SYSTEM command injection.
The 0day Rubbish Research Team publicly disclosed a vulnerability chain in South River Technologies Titan MFT Server 26.0.0.364. The .NET 8 process titanmft.exe runs as Windows service SrtTitanMFTServerService under LocalSystem and exposes a Blazor Server administration interface. A first-run administrator setup issue is chained to job post-command injection, yielding NT AUTHORITY\SYSTEM, with a claimed score of 8.1. No CVE or observed exploitation is stated.
- Affects Titan MFT Server 26.0.0.364 NextGen.
- Windows service runs as LocalSystem.
- First-run administrator setup chains into job command injection.
- Claimed score 8.1; no in-the-wild exploitation stated.
- Vendors
- South River Technologies
- Products
- Titan MFT Server
- Countries
- United States
From the original article
Posted by disclosure via Fulldisclosure on Oct 15 0day Rubbish Research Team is publicly disclosing a vulnerability chain in South River Technologies Titan MFT Server 26. 0. 0.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.