The same Remote Sunrise Helper software that leaks file listings has a bigger problem: unauthenticated remote code execution. Version 2026.14 lets anyone run arbitrary commands on the target machine without credentials.
The mechanism is simple. The /api/executeScript endpoint accepts a script via the X-Script HTTP header and executes it directly. If the version check at /api/getVersion returns requires.auth as false, the door is open. Send a POST request with your command in the header, and the server runs it. No authentication, no sandboxing, no questions asked.
This is about as bad as it gets for a network-facing service. Full system compromise from a single HTTP request. An attacker can chain this with the file listing vulnerability to first enumerate the target and then execute whatever they want.
Again, the vendor hasn’t issued a patch. If you’re running Remote Sunrise Helper on any network — especially one that touches the internet — treat it as compromised. Restrict access to trusted networks only, and ideally place it behind a VPN with strong authentication. Running this software as-is on an exposed port is a genuine emergency.
Credit: Chokri Hammedi. Tested on Windows 10 and 11.
