VULNERABILITY INTELLIGENCE

CVE-2020-5242

CVSS score7.7 HIGH

EPSS probability1.97%

CISA KEVNot currently listed

Published2020-02-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Description

openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file which cannot be changed via REST calls.

Weakness classification

security-advisories@github.com: CWE-284
nvd@nist.gov: CWE-863

Primary references

security-advisories@github.com — Patch, Third Party Advisory
security-advisories@github.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory