An unrestricted file upload vulnerability in Gmission Web Fax allows unauthenticated remote attackers to execute arbitrary code on the underlying system.

This vulnerability consists of improper input validation and unrestricted file upload flaws (CWE-20, CWE-434). An unauthenticated attacker can bypass security controls to upload malicious files, leading to remote code inclusion.

Successful exploitation of this vulnerability allows for full system compromise, as the attacker can execute arbitrary code with the privileges of the web service. Given the CVSS score of 8.4, this represents a high risk of unauthorized data access, potential lateral movement within the network, and complete loss of system integrity.

Immediate Action: Upgrade Gmission Web Fax to version 3.1 or later immediately.

Proactive Monitoring: Inspect web server access logs for anomalous file upload requests or requests targeting suspicious file extensions (e.g., .php, .jsp, .aspx).

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads and restrict access to administrative interfaces from untrusted networks.

Public Exploit Available: No (unknown)

Due to the critical nature of remote code execution, organizations running Gmission Web Fax must treat this as a high-priority update. Apply the vendor-supplied patch immediately to prevent potential exploitation of this easily accessible, unauthenticated attack vector.