CVE-2023-24078

Real Time Logic FuguHub 8.1 and earlier contains a remote code execution flaw reachable through the /FuguHub/cmsdocs/ component. The metrics indicate a low-privileged account is the precondition, so this is an authenticated user turning access to that component into code execution on the host, network-reachable and requiring no user interaction once that low privilege is in hand.

FuguHub is a niche embedded application/server platform, not a mass-market target, so it won't draw the same indiscriminate scanning as a popular CMS, and the low-privilege requirement narrows the attacker pool further to those who can obtain an account. That said, RCE on an embedded server is a strong outcome for whoever does clear the bar, and embedded devices often lack the monitoring that would catch it.

Given the specialized footprint, our first job is discovery, do we run FuguHub anywhere, at 8.1 or earlier, and is its interface exposed. Because it is a specific URL path, /FuguHub/cmsdocs/, it lends itself to a virtual-patch rule and log hunting while updates are arranged, and we would confirm that low-privilege accounts on the platform are tightly controlled since that account is the entry ticket.