CVE-2020-5849KEV · OVERDUE

Unraid Authentication Bypass Vulnerability

High · published March 16, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.5
EPSS
93%
Percentile
99.8
In the wild
Confirmed
What it is

⚡ An authentication bypass in Unraid 6.8.0 lets attackers slip in like a sneaky raccoon into your trash — no password needed! 🔥 Think of it as a locked gate at a festival that somehow has an unguarded side entrance. While everyone else is waiting in line, an attacker can waltz right in and access all the goodies without a ticket! This vulnerability allows an attacker to access sensitive sections of your system without any authentication, potentially leading to unauthorized data access or manipulation. If you use Unraid 6.8.0, this breach could be absolutely devastating — imagine someone taking control of your valuable data without you ever knowing!

Put simply

Think of it as a locked gate at a festival that somehow has an unguarded side entrance. While everyone else is waiting in line, an attacker can waltz right in and access all the goodies without a ticket! CVE-2020-5849 allows attackers to bypass the authentication mechanism in Unraid 6.8.0, enabling them to access the system without valid credentials.

What to do

This vulnerability allows an attacker to access sensitive sections of your system without any authentication, potentially leading to unauthorized data access or manipulation. If you use Unraid 6.8.0, this breach could be absolutely devastating — imagine someone taking control of your valuable data without you ever knowing! To protect yourself, upgrade Unraid to the latest version immediately. Additionally, consider tightening your network security measures to limit unauthorized access. Regularly review your access logs for any suspicious activity, just to be safe! You've got this! With a quick update and some extra precautions, you'll have your system secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.93243 · 99.8th percentile
Published
2020-03-16T17:24Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 16 MAR 17:24Z
    Unraid 6.8.0 allows authentication bypass
    cvelistv5