CVE-2020-22000

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin

published April 27, 2021

CVSS
—
EPSS
1%
Percentile
64.2
In the wild
Unconfirmed
What it is

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'set_command_on' and 'set_command_off' POST parameters in '/system/systemplugins/customcommand/customcommand.plugin.php' by using an unsanitized PHP exec() function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01059 · 64.2th percentile
Published
2021-04-27T17:51Z
EPSS history
Timeline
  • 27 APR 17:51Z
    HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin
    cvelistv5