A critical authentication bypass in GFI Archiver version 15.10 allows unauthenticated remote attackers to access sensitive functionality and potentially execute code as SYSTEM.

The vulnerability is caused by a missing authorization check in the MArc.Core.Remoting.exe process, which listens on TCP port 8017. This flaw allows an unauthenticated remote attacker to interact with the service without valid credentials.

The ability for an unauthenticated user to bypass authorization mechanisms poses a severe risk to organizational data integrity and system availability. Given the CVSS score of 7.3, this high severity vulnerability could be chained with additional flaws to facilitate full system compromise under the SYSTEM account, leading to total loss of confidentiality, integrity, and availability of the archived data.

Immediate Action: Update GFI Archiver to the latest version provided by the vendor to resolve the missing authorization flaw in the MArc.Core process.

Proactive Monitoring: Monitor network traffic directed toward port 8017 for unauthorized connection attempts or anomalous remote procedure call patterns.

Compensating Controls: Restrict network access to the GFI Archiver management interface and associated remoting ports to trusted IP addresses only via firewall rules to prevent external exploitation.

Public Exploit Available: Unknown.

This vulnerability represents a significant security oversight that exposes the core remoting functionality of GFI Archiver to unauthorized access. Organizations should prioritize patching this installation immediately to eliminate the possibility of remote exploitation. If an immediate update is not feasible, ensure that the affected port is strictly firewalled from all untrusted networks to reduce the immediate attack surface.