CVE-2020-29552 Command injection in n/a

Critical 9.8 Published 23 Dec 2020 Updated 4 Aug 2024

Attackers can execute arbitrary PowerShell commands via the vpro.php endpoint, leading to remote code execution on the server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-29552?

CVE-2020-29552 is a critical command injection vulnerability in n/a, published on 23 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" substring, it is possible to execute a Powershell command and redirect its output to a file under the web root.

Weakness: CWE-78

Which versions are affected by CVE-2020-29552?

It affects 1 product.

Products include Urve Urve.

How do I fix CVE-2020-29552?

No fix has been published for CVE-2020-29552 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-29552 being exploited?

There is no known exploitation of CVE-2020-29552 in the wild and no public exploit code.

Sources

Also known as GHSA-jh96-fr92-882g.