CVE-2020-5242CWE-284

openHAB exec add-ons allow remote arbitrary command execution

High · published February 20, 2020

CVSS v3.1
7.7
EPSS
2%
Percentile
80.3
In the wild
Unconfirmed
What it is

openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file which cannot be changed via REST calls.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01973 · 80.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2020-02-20T22:55Z
EPSS history
Timeline
  • 20 FEB 22:55Z
    openHAB exec add-ons allow remote arbitrary command execution
    cvelistv5