CVE-2020-37002

High CVSS: 8.7

Ajenti 2.1.36 contains an authentication bypass vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port.

Vendor

Product

CWE

CWE-78

Yayın Tarihi

2026-01-29 15:16:06

Güncelleme

2026-01-29 16:31:00

Source Identifier

disclosure@vulncheck.com

KEV Date Added

Kategoriler

CWE-78 HIGH 2026

Referanslar

https://github.com/ajenti/ajenti https://www.exploit-db.com/exploits/48929 https://www.vulncheck.com/advisories/ajenti-remote-code-execution