An authenticated remote code execution vulnerability in Amidaware Tactical RMM allows low-privileged users to compromise the underlying server via template injection.

This is a Server-Side Template Injection (SSTI) vulnerability located in the /reporting/templates/preview/ endpoint. It occurs due to improper sanitization of the template_md parameter within the generate_html function, allowing authenticated users with Report Viewer or Report Manager permissions to inject arbitrary Jinja2 templates and execute system commands.

The ability for a low-privileged user to achieve remote command execution represents a critical security risk. Successful exploitation could lead to full system compromise, allowing an attacker to gain unauthorized access to managed endpoints, exfiltrate sensitive monitoring data, or disrupt business operations. Given the CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality, integrity, and availability of the Tactical RMM environment.

Immediate Action: Update Amidaware Tactical RMM to a version beyond v1.3.1 that incorporates the fix for the template injection flaw.

Proactive Monitoring: Monitor server access logs for unusual activity originating from the /reporting/templates/preview/ endpoint, particularly requests containing Jinja2 syntax or suspicious command strings.

Compensating Controls: Restrict access to reporting features to only the most trusted personnel until the patch is applied, and implement Web Application Firewall (WAF) rules to detect and block SSTI patterns in HTTP parameters.

Public Exploit Available: Yes, a Metasploit module is available for this vulnerability.

This vulnerability is highly severe due to the potential for full server compromise by authenticated users. Administrators should prioritize patching Tactical RMM immediately to remove the vulnerable template processing logic. Relying solely on access controls is insufficient given the availability of public exploit modules, making the vendor-supplied update the only reliable method for mitigation.