CVE-2020-5242
openHAB exec add-ons allow remote arbitrary command execution
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.7EPSS 2.0%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
20 feb 2020Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file which cannot be changed via REST calls.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Productos afectados
openhab · openhab-addons¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →