What is CVE-2020-11920?

CVE-2020-11920 is a critical-severity vulnerability in Svakom Siime Eye, classified under OS Command Injection. CVSS score: 9.8/10. Published 2021-02-08.

How severe is CVE-2020-11920?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2020-11920 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Svakom Siime Eye

CVE-2020-11920

An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here, the device executes arbitrary code with root privileges (all of the device's services are running as root).

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.042 (89.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Svakom Siime_eye
Svakom Siime_eye_firmware — versions 14.1.00000001.3.330.0.0.3.14
N/a — versions n/a

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

cve@mitre.org (Exploit, Third Party Advisory)
cve@mitre.org (mailing-list)

Frequently asked questions

What is CVE-2020-11920?: CVE-2020-11920 is a critical-severity vulnerability in Svakom Siime Eye, classified under OS Command Injection. CVSS score: 9.8/10. Published 2021-02-08.
How severe is CVE-2020-11920?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-11920 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.