CVE-2018-7756

DEWESoft X3 SP1 (64-bit) includes an installer/utility component that opens a network “door” on TCP port 1999. The problem is that the door doesn’t check who is knocking—so someone who can reach that port can send commands. Depending on the command, they may be able to run malicious programs or switch off the device’s firewall, making it easier to attack further.

This matters if you run or maintain DEWESoft X3 SP1 (64-bit) devices. It’s especially relevant when TCP port 1999 is reachable from other networks, because the vulnerability does not require authentication and can be triggered by anyone who can reach the port. If TCP port 1999 is not reachable from untrusted networks (for example, not exposed to the internet and restricted to trusted systems only), the risk is reduced.

Treat this as urgent because attackers can send commands to the device without any login and can directly disable firewall protections or run malicious code. Public exploits are available and exposure has been getting more attention, so you should address it now rather than waiting for a later window.

1. Confirm exposure (quick check)

   • Identify all systems running DEWESoft X3 SP1 (64-bit).
   • From a host you control (or your network monitoring tool), test whether TCP port 1999 on those devices is reachable from untrusted networks (e.g., anywhere outside your local trusted network).
   • If you have a firewall or router in front of the device, verify inbound rules for TCP port 1999.

2. Confirm the software affected

   • Verify the exact DEWESoft version and service pack level on each device.
   • This CVE is specifically tied to DEWESoft X3 SP1 (64-bit) devices.

3. Immediate containment while waiting for an update

   • Block TCP port 1999 from the internet and from any untrusted networks.
   • Allow inbound access only from the specific trusted systems that truly need it (or remove the rule entirely if it’s not required for normal operation).
   • If you can’t safely remove network reachability, place the device on a tightly controlled network segment that only authorized machines can access.

4. Apply vendor remediation

   • Follow the vendor’s update/remediation guidance when the update that removes the TCP port 1999 unauthenticated command behavior is released.
   • Update the affected devices to the fixed version provided by DEWESoft (the provided finding indicates remediation is not fully available yet until an update is released).

5. Post-update verification and monitoring

   • Re-test that TCP port 1999 is no longer reachable from untrusted networks.
   • Review device/network logs for signs of unusual inbound command activity around the time the exposure may have occurred.
   • Confirm firewall settings remain enabled and that no unexpected changes were made.

Note on timing: No CISA KEV listing was provided for this CVE in the findings. The finding set indicates public exploits exist, which is a strong reason to act promptly even without KEV.

Severity is high because the vulnerability allows unauthenticated remote control over a listening network port. The findings describe Remote Code Execution and “SETFIREWALL Off”-style behavior, meaning an attacker can both run arbitrary code and disable host firewall protections.

Mechanism/trigger: An attacker sends specific instructions over the network to the open service port TCP port 1999; no authentication is required. The exploitability is supported by the findings noting a public exploit is available and that network reachability to the port is the key precondition.

CWE: CWE-94 (code injection / improper control of code execution).

Exploitation status maturity: Public exploit availability is confirmed by the findings. KEV is not listed (per findings), but press attention is rising.

Likelihood metrics: EPSS indicates a predicted likelihood with a rising trend, but per instructions, this is not presented as a definitive claim of real-world exploitation.