CVE-2020-21224

A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

38.75% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-88

Published

2021-02-22

Updated

2024-08-04

Proof-of-concept exploits (1)

• NS-Sp4ce/Inspur/tree/master/ClusterEngineV4.0%20Vul

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-21224.yaml

Exploit collections (3)

• chaitin/xray/blob/master/pocs/inspur-tscev4-cve-2020-21224-rce.yml
• tzwlhack/Vulnerability/blob/main/%E6%B5%AA%E6%BD%AE%20ClusterEngineV4.0%20%E9%9B%86%E7%BE…
• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-21224.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2020-14882
• CVE-2021-21972
• CVE-2020-21180
• CVE-2020-21228
• CVE-2020-21179
• CVE-2020-21236