CVE-2020-37002
Published: 29 January 2026
Description
Ajenti 2.1.36 contains an authentication bypass vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port.
Mitigating Controls (NIST 800-53 r5)AI
Remediating the specific authentication bypass and command injection flaw in Ajenti 2.1.36 via vendor patches directly prevents exploitation of CVE-2020-37002.
Validating inputs to the /api/terminal/create endpoint blocks arbitrary OS command injection payloads such as netcat reverse shells.
Enforcing logical access controls on sensitive terminal endpoints limits unauthorized command execution even in cases of authentication bypass.
Security SummaryAI
CVE-2020-37002 is an authentication bypass vulnerability affecting Ajenti version 2.1.36, a web-based Linux system administration panel. The flaw enables remote attackers to execute arbitrary commands after a successful login, stemming from improper handling that classifies it as CWE-78 (OS Command Injection). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critically severe due to its network reachability, low complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.
Remote attackers can exploit this vulnerability without prior authentication privileges by targeting the /api/terminal/create endpoint. This allows them to inject and execute arbitrary commands, such as a netcat reverse shell payload directed at an attacker-controlled IP and port, achieving full remote code execution on the vulnerable Ajenti server.
Mitigation guidance and patch details are available in referenced advisories, including the Ajenti GitHub repository at https://github.com/ajenti/ajenti, an Exploit-DB proof-of-concept at https://www.exploit-db.com/exploits/48929, and a Vulncheck advisory at https://www.vulncheck.com/advisories/ajenti-remote-code-execution. Security practitioners should consult these for upgrade instructions and remediation steps.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of a public-facing web application (Ajenti panel) for unauthenticated remote command execution via OS command injection in a Unix/Linux environment.