Security Advisory

CVE-2020-22000

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2021-04-27 17:51:17

Last updated 2024-08-04 14:30:33

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'set_command_on' and 'set_command_off' POST parameters in '/system/systemplugins/customcommand/customcommand.plugin.php' by using an unsanitized PHP exec() function.

← Browse all CVEs View on cve.org ↗