critical9.8Public exploit code
CVE-2020-7980
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Satellian 1.12 - Remote Code Execution2020-01-29 · webapps · hardware
Impact
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Intelliantech | Aptus Web | Version 1.24 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/156143/Satellian-1.12-Remote-Code-Execution.html
- https://github.com/Xh4H/Satellian-CVE-2020-7980
- https://sku11army.blogspot.com/2020/01/intellian-aptus-web-rce-intellian.html
- http://packetstormsecurity.com/files/156143/Satellian-1.12-Remote-Code-Execution.html
- https://github.com/Xh4H/Satellian-CVE-2020-7980
- https://sku11army.blogspot.com/2020/01/intellian-aptus-web-rce-intellian.html