Posted by disclosure via Fulldisclosure on Aug 06 0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV Server 10.7.8 (Square Box Systems). The

research is published and a proof-of-concept is available.

Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)

A three-defect chain turns any deployment into an unauthenticated root RCE. An RMI connect(null) path makes the server

mint a ClientID using its own internal client.regcode system property (zero...