POC for unauthenticated RCE in Aspect Unified Installation Assistant by Aspect Software 7.34.1000.003205 found in the end of 2021.

I did try to contant Aspect Software without any luck.

The service expose a WCF TCP.NET service accessible without auth. The WCF service has a public an Exec method (among others) that can be used to execute commands as the logged in user (or SYSTEM, if noone is logged in).

This can be exploited by implementing a WCF client calling the Exec method on the WCF endpoint.

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe AspectInstallAssistantRCE.cs /reference:MonoTorrent.dll

AspectInstallAssistantRCE.exe 192.168.42.132 calc.exe