CVE-2020-5752
CVE-2020-5752
Vexday Risk Score
38Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Popular PoC on GitHub (4 stars) — exploitation code widely available.
CVSS —EPSS 8.6%KEV nãoPoC públicaNuclei —Metasploit simPatch —
Lifecycle
25 Feb 2020Metasploit module available
21 May 2020Published on NVD
22 May 2020Public PoC
Weaponization speed
same dayto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Plan a near-term fix — a public PoC already exists.
Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.
Affected products
n/a · Druva inSync Windows Clientpublic PoCs found — 6
githubgithub.com/yevh/CVE-2020-5752-Druva-inSync-Windows-Client-6.6.3---Local-Privilege-Escalation-PowerShell-★ 4githubgithub.com/x0rbeexd/CVE-2020-5752★ 1cve_referencepacketstormsecurity.com/files/157802/Druva-inSync-Windows-Client-6.6.3-Local-Privilege-Escalation.htmlunverifiedcve_referencepacketstormsecurity.com/files/160404/Druva-inSync-Windows-Client-6.6.3-Privilege-Escalation.htmlunverifiedexploitdbwww.exploit-db.com/exploits/48505unverifiedexploitdbwww.exploit-db.com/exploits/49211unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.