CVE-2020-5849
Unraid 6.8.0 allows authentication bypass.
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- January 06, 2020
- Published Date
- March 16, 2020
- Last Updated
- February 04, 2025
- Vendor
- n/a
- Product
- n/a
- Description
- Unraid 6.8.0 allows authentication bypass.
CVSS Scores
SSVC Information
- Exploitation
- active
- Automatable
- Yes
- Technical Impact
- partial
Exploit Status
- Exploited in the Wild
- Yes (added 2021-11-03 00:00:00 UTC) Source
References
https://sysdream.com/news/lab/
https://forums.unraid.net/forum/7-announcements/
https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/
http://packetstormsecurity.com/files/157275/Unraid-6.8.0-Authentication-Bypass-Arbitrary-Code-Execution.html
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CISA | 2021-11-03 00:00:00 UTC |
Scanner Integrations
| Scanner | URL | Date Detected |
|---|---|---|
| Metasploit | https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/unraid_auth_bypass_exec.rb | 2025-04-29 11:01:15 UTC |
Potential Proof of Concepts
Warning: These PoCs have not been tested and could contain malware. Use at your own risk.
unraid_auth_bypass_exec
Type: metasploit • Created: Unknown
Metasploit module for CVE-2020-5849