A critical XXE vulnerability in TecCom TecConnect 4.1 allows unauthenticated attackers to exfiltrate sensitive system files, posing a severe risk to data confidentiality.

This vulnerability is an XML External Entity (XXE) injection (CWE-611) occurring within the OpenMessaging webservice. It allows an unauthenticated remote attacker to perform unauthorized file reads by injecting malicious XML input.

The ability to exfiltrate arbitrary files from the host server can lead to the exposure of configuration files, credentials, or sensitive business data. Given the CVSS score of 9.1, this vulnerability presents a high risk of total system compromise or information disclosure, potentially leading to further lateral movement within the network.

Immediate Action: Contact the vendor for the latest security patch or update guidance, as a specific patch version is not currently listed.

Proactive Monitoring: Monitor network traffic for unusual XML payloads targeting the OpenMessaging webservice and review server access logs for anomalous file read requests.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block XML entities and DTD declarations in incoming web requests.

Public Exploit Available: Unknown

Due to the critical severity and the existence of a proof-of-concept, organizations running TecCom TecConnect 4.1 must prioritize mitigation. If a vendor patch is unavailable, restrict network access to the affected webservice immediately to prevent unauthorized exploitation.