Posted by disclosure via Fulldisclosure on Aug 170day Rubbish Research Team is publicly disclosing a vulnerability in iMonnit Express 4.0.5.5 (Monnit / iMonnit). The research is published and a proof-of-concept is available. Pre-authentication SYSTEM RCE (CVSS 9.8, pre-authentication) iMonnit Express 4.0.5.5 is an ASP.NET Core application running as a Windows service with LocalSystem privileges, with no global [Authorize] filter. Three flaws combine into a fully unauthenticated root RCE...