CVE-2020-5847criticalunder attack

CVE-2020-5847

Published · Updated

Follow this CVE+ Monitor Unraid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 96%
from disclosure to weapon35 days
Published on NVDMar 16
1st PoC+35d
metasploitFeb 10
CISA KEV+597d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Unraid versions up to 6.8.0 have a critical flaw that allows attackers to run malicious code remotely on the system without any authentication required. This means someone from the internet could take complete control of your Unraid server.

Technical detail

CVE-2020-5847 is a remote code execution vulnerability in Unraid ≤6.8.0 that permits unauthenticated remote attackers to execute arbitrary code on the affected system. The vulnerability requires network access but no prior authentication or user interaction, resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unraid through 6.8.0 allows Remote Code Execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.