CVE-2020-14293

conf_datetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field (obtained from the web interface).

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS

5.26% chance of exploitation in the next 30 days, 92nd percentile

Published

2020-10-02

Updated

2024-08-04

Proof-of-concept exploits (2)

• http://seclists.org/fulldisclosure/2020/Sep/51
• patrickhener/CVE-2020-142931★ · 2020-10-02

Security advisories

• https://www.secudos.de/en/news-en/domos-release-5-9
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-025.txt
• https://www.syss.de/pentest-blog/syss-2020-024-und-syss-2020-025-zwei-schwachstellen-in-f…

References

• CVE Record
• NVD entry

Related

• CVE-2020-14294
• CVE-2020-15492
• CVE-2023-22855