CVE-2023-24078: FuguHub code injection in cmsdocs enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with public exploit code and very high EPSS (98.9th percentile) make this a high-priority remote code execution risk, though it requires authentication and is not in KEV.

What it is

Real Time Logic FuguHub v8.1 and earlier contains a code injection flaw (CWE-94) in the /FuguHub/cmsdocs/ component that allows remote code execution. The CVSS 3.1 score is 8.8 (High), and public exploit code exists, so the flaw is practically reachable for attackers.

Impact

An authenticated attacker can execute arbitrary code on the FuguHub server, gaining full control of confidentiality, integrity and availability of the host. This can lead to data theft, service disruption or use of the server as a foothold.

Attack surface

The vulnerability is reached over the network through the /FuguHub/cmsdocs/ component. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates low privileges are required but no user interaction, so any authenticated low-privileged user can attempt it.

Exploitation

Public exploit code is referenced (GitHub and Packet Storm), and EPSS is 0.52958 (98.9th percentile), indicating a high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded here.

What to do

• Upgrade FuguHub to a version later than 8.1 if the vendor provides one; the record does not list fixed versions, so verify with Real Time Logic.
• Restrict network access to the /FuguHub/cmsdocs/ endpoint to trusted users or internal networks only.
• Enforce least privilege and review which accounts can authenticate to FuguHub, since the flaw requires only low privileges.
• Monitor and block exploit attempts using the public proof-of-concept payloads as detection signatures.
• If patching is not possible, consider disabling or isolating the cmsdocs component until a fix is available.

Detection

• Monitor web server and FuguHub logs for requests to /FuguHub/cmsdocs/ with suspicious parameters or payload patterns.
• Look for unexpected child processes or command execution spawned by the FuguHub service account.
• Alert on outbound connections or file writes from the FuguHub process that deviate from normal CMS behavior.
• Use the public exploit code from the referenced GitHub and Packet Storm links to build IDS/IPS signatures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.