Remote Sunrise Helper for Windows version 2026.14 contains a vulnerability that allows unauthenticated users to list files and directories on the target machine. No login required.
The exploit is blunt. The application runs an HTTPS server on port 49762. By checking the /api/getVersion endpoint, an attacker can determine whether the instance requires authentication. If requires.auth returns false, the /api/listFiles endpoint is wide open. You can even specify a path — C:/Users, for example — and browse the filesystem at will.
This is an information disclosure issue at its core, but don’t underestimate it. Knowing the file structure, user directories, and configuration file locations paves the way for targeted follow-up attacks. Combined with the remote code execution flaw in the same software (separate disclosure), full compromise becomes trivial.
The vendor, rs.ltd, hasn’t released a patch as of this writing. The most effective mitigation is ensuring the application isn’t exposed to untrusted networks. If Remote Sunrise Helper must be accessible remotely, put it behind proper authentication at the network level — a VPN, for instance. Direct internet exposure is asking for trouble.
Discovered by Chokri Hammedi. Tested on Windows 10 and Windows 11.
