NoMachine: Remote Code Execution vulnerability
A vulnerability in NoMachine allows a remote, unauthenticated attacker to execute arbitrary code on the target system.
Triage facts
Revision 1- Applicability
- NoMachine
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 17:35 UTC
- Source quality
- A1Likely
A vulnerability in NoMachine allows a remote, unauthenticated attacker to execute arbitrary code. The BSI advisory notes that the vulnerability can be exploited by an anonymous attacker, but specific CVE identifiers or technical details regarding the vulnerability class were not disclosed in the initial advisory.
Impact
Successful exploitation allows for arbitrary code execution on systems running the affected NoMachine software.
Recommendation
- Inventory all systems running NoMachine across the environment.
- Monitor NoMachine services for the spawning of unexpected child processes or abnormal outbound network connections.
- Review official NoMachine security update channels for patch availability and apply updates immediately upon release.
Immediate actions
Identify and inventory all internal servers and workstations running the NoMachine software
Threat Hunt
Monitor for suspicious child processes spawned by nxserver or associated NoMachine daemon processes
Data: Endpoint process creation logs
Mitigations
Monitor the official NoMachine vendor advisory page for a patch and deploy to all affected assets
NoMachine software