CVE-2014-4872

CVE-2014-4872 is a critical authentication bypass vulnerability affecting BMC Track-It! 11.3.0.355. It allows unauthenticated remote attackers to upload arbitrary files, execute arbitrary code, or steal sensitive credentials and configuration data via .NET Remoting requests to specific services on TCP port 9010. With a CVSS score of 7.5 and a FAUCET Risk Score of 99/100, this vulnerability presents a high risk due to its network-based attack vector and lack of authentication, leading to potential complete compromise of confidentiality, integrity, and availability. While not on the KEV catalog, exploit modules are publicly available in Metasploit and ExploitDB, and it has garnered significant community discussion and media coverage, indicating a high likelihood of exploitation.