Cyber Posture

CVE-2020-37002

CriticalPublic PoC

Published: 29 January 2026

Published
29 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0055 68.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Ajenti 2.1.36 contains an authentication bypass vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Remediating the specific authentication bypass and command injection flaw in Ajenti 2.1.36 via vendor patches directly prevents exploitation of CVE-2020-37002.

prevent

Validating inputs to the /api/terminal/create endpoint blocks arbitrary OS command injection payloads such as netcat reverse shells.

prevent

Enforcing logical access controls on sensitive terminal endpoints limits unauthorized command execution even in cases of authentication bypass.

Security SummaryAI

CVE-2020-37002 is an authentication bypass vulnerability affecting Ajenti version 2.1.36, a web-based Linux system administration panel. The flaw enables remote attackers to execute arbitrary commands after a successful login, stemming from improper handling that classifies it as CWE-78 (OS Command Injection). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critically severe due to its network reachability, low complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.

Remote attackers can exploit this vulnerability without prior authentication privileges by targeting the /api/terminal/create endpoint. This allows them to inject and execute arbitrary commands, such as a netcat reverse shell payload directed at an attacker-controlled IP and port, achieving full remote code execution on the vulnerable Ajenti server.

Mitigation guidance and patch details are available in referenced advisories, including the Ajenti GitHub repository at https://github.com/ajenti/ajenti, an Exploit-DB proof-of-concept at https://www.exploit-db.com/exploits/48929, and a Vulncheck advisory at https://www.vulncheck.com/advisories/ajenti-remote-code-execution. Security practitioners should consult these for upgrade instructions and remediation steps.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

CVE enables exploitation of a public-facing web application (Ajenti panel) for unauthenticated remote command execution via OS command injection in a Unix/Linux environment.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References