CVE-2014-4872: BMC Track-It! unauthenticated .NET Remoting service allows file upload and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution and credential disclosure on a network-reachable service, tempered only by the age of the product and lack of confirmed in-the-wild exploitation in this record.

What it is

BMC Track-It! 11.3.0.355 exposes TCP port 9010 without requiring authentication, and its FileStorageService and ConfigurationService accept .NET Remoting requests from anyone who can reach the port. Because those services handle file storage and configuration, an unauthenticated remote party can upload arbitrary files, run code, or pull credential and configuration data. The flaw is a missing-authentication issue on a critical function, so exposure is limited to hosts with the port reachable but the consequences are severe where it is.

Impact

An attacker gains the ability to write arbitrary files and execute code on the Track-It! server, plus read sensitive credentials and configuration. That is effectively full compromise of the application host and any credentials it stores.

Attack surface

Reachable over the network via a .NET Remoting request to TCP port 9010; no authentication and no user interaction are required per the description and the AV:N/AC:L/Au:N vector. Any host that can route to port 9010 on the Track-It! server can attempt it.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.793 probability over 30 days, 99.58th percentile), and public references include a proof-of-concept writeup and a CERT/CC advisory, indicating exploit knowledge is widely available.

What to do

• Apply the vendor fix for Track-It! or upgrade to a release that authenticates the port 9010 services; patch first.
• If no patch is available, block TCP port 9010 at the perimeter and host firewall so only trusted management hosts can reach it.
• Isolate the Track-It! server on a segmented management network with no direct internet exposure.
• Rotate any credentials and configuration secrets stored or transmitted by Track-It! in case they were already read.
• Monitor for unexpected files written into Track-It! application or storage directories.

Detection

• Alert on inbound connections to TCP port 9010 from hosts outside the expected management range.
• Inspect network traffic for .NET Remoting requests to FileStorageService or ConfigurationService on port 9010.
• Watch for new or modified files in Track-It! storage and application directories outside normal change windows.
• Review Track-It! server logs and process creation for unexpected child processes or service restarts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.