CVE-2020-7209

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	LinuxKI	6.0-1 and earlier

References

http://packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2Third Party Advisory
http://packetstormsecurity.com/files/157739/HP-LinuxKI-6.01-Remote-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/158025/LinuxKI-Toolset-6.01-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/HewlettPackard/LinuxKI/releases/tag/v6.0-2Third Party Advisory

Timeline

Published: Feb 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-72104.3Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.CVE-2020-72117.5tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.CVE-2020-72127.5The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU co CVE-2020-72137.5Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presen CVE-2020-72155.5An issue was discovered in Gallagher Command Centre 7.x before 7.90.991(MR5), 8.00 before 8.00.1161(MR5), and 8.10 before 8.10.1134(MR4). Ex CVE-2020-72167.5An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sendin CVE-2020-72177.5An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service CVE-2020-72187.5HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticate CVE-2020-72197.5HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticat CVE-2020-72207.5HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespac CVE-2020-72217.8mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root because chown and chmod a CVE-2020-72225.3An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one