CVE-2020-25094

2020-12-1702:04:12

mitre

www.cve.org

logrhythm

platform manager

command injection

cve-2020-25094

websocket

smart response agent

localsystem privileges

AI Score

9.6

Confidence

High

EPSS

0.013

Percentile

86.3%

JSON

LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges.

References

cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/