CVE-2024-23692: Rejetto HTTP File Server template injection leads to unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a 9.8 CVSS score, KEV listing with known ransomware use, near-maximum EPSS, and public exploit code make this an urgent patch-or-remove case.

What it is

Rejetto HTTP File Server through version 2.3m is vulnerable to template injection, allowing a remote unauthenticated attacker to execute arbitrary commands via a crafted HTTP request. The flaw is critical because it requires no credentials or user interaction and the affected version is no longer supported, so no vendor patch is expected.

Impact

An attacker gains arbitrary command execution on the host running HFS, typically leading to full system compromise under the service account. Given KEV listing with known ransomware use, this can serve as an initial access vector for broader intrusion.

Attack surface

Reachable over the network through the HFS HTTP interface; the CVSS vector shows no privileges required and no user interaction, so any exposed instance is directly attackable.

Exploitation

CVE-2024-23692 is in CISA KEV with known ransomware campaign use, EPSS probability is about 0.995 (99.9th percentile), and multiple references are tagged Exploit including a Metasploit module, indicating active and public exploitation.

What to do

• Discontinue use of Rejetto HFS 2.3m or migrate to a supported file server, since the affected version is end-of-life and no vendor patch exists.
• If HFS must remain, remove it from internet exposure and restrict access to trusted internal networks only.
• Apply vendor or CISA-recommended mitigations and compensating controls such as network segmentation and least-privilege service accounts.
• Hunt for and remove any existing HFS installations, then verify no unauthorized persistence or web shells were left behind.
• Monitor CISA KEV guidance and apply the required action by the listed due date.

Detection

• Inspect HTTP request logs for HFS template syntax or macro expressions in request parameters, headers, or paths.
• Alert on HFS process spawning child processes such as cmd.exe, powershell.exe, or /bin/sh.
• Search hosts for hfs.exe or Rejetto HFS artifacts and correlate with outbound connections or new listening services.
• Review network traffic to HFS ports for anomalous POST or GET requests containing encoded command strings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.