Cyber Posture

CVE-2020-37027

CriticalPublic PoC

Published: 30 January 2026

Published
30 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0073 72.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can set malicious commands in the extra scripts field and trigger processing to execute remote code on the…

more

vulnerable Sickbeard installation.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by requiring validation of untrusted inputs to the extra scripts configuration field.

AC-3 Access Enforcement good match
prevent

Enforces logical access controls to block unauthenticated attackers from modifying the extra scripts field.

SI-2 Flaw Remediation good match
prevent

Mandates timely remediation of the specific command injection flaw in Sickbeard to eliminate the vulnerability.

Security SummaryAI

CVE-2020-37027 is a remote command injection vulnerability (CWE-78) in Sickbeard alpha, an open-source TV show management application. The flaw resides in the extra scripts configuration, where attackers can inject and execute arbitrary commands on the server hosting the vulnerable Sickbeard installation.

Unauthenticated remote attackers can exploit this vulnerability by submitting malicious commands via the extra scripts field and triggering the processing mechanism, resulting in arbitrary remote code execution. The CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects its critical severity, with low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.

Advisories and references, including the VulnCheck advisory on Sickbeard remote command injection, the Sick-Beard GitHub repository, an archived Sickbeard website, and an Exploit-DB entry (exploit 48646), document the issue but do not specify patches or mitigations in the available details. A public proof-of-concept exploit is available on Exploit-DB, underscoring the risk for internet-exposed Sickbeard instances.

Details

CWE(s)
CWE-78

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

Unauthenticated remote command injection in a public-facing TV show management application (Sickbeard) enables exploitation of public-facing applications (T1190) and facilitates arbitrary OS command execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References