CVE-2018-7756: DEWESoft X3 installer RunExeFile.exe unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, public exploit code, and very high EPSS make this an urgent remote code execution risk for exposed DEWESoft X3 SP1 systems.

What it is

RunExeFile.exe in the DEWESoft X3 SP1 (64-bit) installer exposes a TCP service on port 1999 that accepts sessions without authentication. A remote attacker can send internal commands, including RUN to launch an arbitrary .EXE from an external URL and SETFIREWALL Off to disable the firewall, leading to arbitrary code execution. The flaw is a code injection issue in the installer component.

Impact

An unauthenticated remote attacker can execute arbitrary code on the affected device and run internal commands, including disabling the firewall. This gives full control over the host with high impact to confidentiality, integrity and availability.

Attack surface

Reachable over the network via TCP port 1999; the CVSS vector shows no privileges and no user interaction required. Any host that can reach that port on a DEWESoft X3 SP1 (64-bit) system can attempt the attack.

Exploitation

Public exploit code exists (Exploit-DB 44275 and the Hyp3rlinx advisory), and EPSS is 0.60741 (99.1st percentile), indicating a high likelihood of exploitation activity. CVE-2018-7756 is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded there.

What to do

• Patch or upgrade DEWESoft X3 SP1 to a fixed release if the vendor provides one; verify with DEWESoft support since the record does not list fixed versions.
• Block or restrict TCP port 1999 at host and network firewalls so only trusted management hosts can reach it.
• Remove or disable RunExeFile.exe where it is not required, and do not run the installer component as a persistent service.
• Segment DEWESoft devices on an isolated control network with no direct internet access, and monitor for outbound connections to external URLs.
• Enforce application allowlisting so unsigned or unexpected .EXE files cannot execute on these systems.

Detection

• Monitor network traffic for TCP connections to port 1999 and for RUN or SETFIREWALL command strings in session data.
• Alert on RunExeFile.exe process creation and on child processes it spawns, especially executables launched from external or temporary paths.
• Watch for firewall configuration changes or disabled firewall state on DEWESoft hosts.
• Review outbound HTTP/HTTPS connections from DEWESoft devices to unknown external URLs for .EXE downloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.