CVE-2020-5847

CRITICAL CISA KEV EPSS 99.9%

Published Mar 16, 20206y ago · Modified Jun 17, 20262w ago

9.8 CVSS 3.1

Critical

Published Mar 16, 2020 6y ago

Last Modified Jun 17, 2026 2w ago

KEV Listed Nov 3, 2021 4y ago

KEV Due May 3, 2022 1521d overdue

Description

Unraid through 6.8.0 allows Remote Code Execution.

Base Score

9.8

Exploitability

3.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

CISA Known Exploited Overdue 1521d

Apply updates per vendor instructions.

EPSS Exploit Probability

99.9% percentile

Exploit & Patch Status

Actively Exploited (KEV)

No Patch Available

Vendor	Product	Version	Range
unraid	unraid	*	≤6.8.0

packetstormsecurity.com http://packetstormsecurity.com/files/157275/Unraid-6.8.0-Authentication-Bypass-Arbitrary-Code-Execution.html

ExploitThird Party AdvisoryVDB Entry
forums.unraid.net https://forums.unraid.net/forum/7-announcements/

Release NotesVendor Advisory
sysdream.com https://sysdream.com/news/lab/

Third Party Advisory
sysdream.com https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/

Broken LinkExploitThird Party Advisory
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5847

US Government Resource

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.