A critical vulnerability in Gmission Web Fax allows for Remote Code Inclusion, posing a severe risk of unauthorized system control.

The vulnerability stems from improper input validation and unrestricted file uploads. These flaws can be leveraged by an attacker to upload malicious files, potentially resulting in Remote Code Inclusion (RCI) on the host server.

The CVSS score of 8.4 reflects the high risk associated with Remote Code Inclusion, which could allow an attacker to execute arbitrary code with the privileges of the web application. This level of access typically leads to total system compromise, data exfiltration, and the potential for lateral movement within the corporate network.

Immediate Action: Identify all instances of Gmission Web Fax and apply the latest security patches provided by the vendor.

Proactive Monitoring: Inspect web server directories for unauthorized files and monitor system logs for suspicious execution patterns or outbound connections from the web server.

Compensating Controls: Restrict file upload functionality if not strictly necessary, and employ a Web Application Firewall (WAF) to block malicious file types and suspicious input payloads.

Public Exploit Available: false

Given the potential for Remote Code Inclusion, this vulnerability must be treated as a critical priority. Administrators should apply the vendor's patch immediately and conduct a thorough security audit of the affected servers to ensure no malicious artifacts have been introduced.