A pre-authentication remote code execution (RCE) vulnerability in the XWorm C2 control panel affects all versions up to v7.4. Discovered by researcher mootoo. Exploitation uses path traversal to replace FastColoredTextBox.dll and execute code with administrator privileges on the C2 server.
Additional sources:
- Sploitus: documents the vulnerability as a 0-Day RCE.
- Zero Redgem: vulnerability page ID 381DD3C1-F27F-5E26-98A8-DC450B72A2E1.