CVE-2020-37002
Published: 29 January 2026
Summary
CVE-2020-37002 is a high-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2020-37002 is an authentication bypass vulnerability affecting Ajenti version 2.1.36, a web-based Linux system administration panel. The flaw enables remote attackers to execute arbitrary commands after a successful login, stemming from improper handling that classifies it as CWE-78 (OS Command Injection). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critically severe due to its network reachability, low complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.
Remote attackers can exploit this vulnerability without prior authentication privileges by targeting the /api/terminal/create endpoint. This allows them to inject and execute arbitrary commands, such as a netcat reverse shell payload directed at an attacker-controlled IP and port, achieving full remote code execution on the vulnerable Ajenti server.
Mitigation guidance and patch details are available in referenced advisories, including the Ajenti GitHub repository at https://github.com/ajenti/ajenti, an Exploit-DB proof-of-concept at https://www.exploit-db.com/exploits/48929, and a Vulncheck advisory at https://www.vulncheck.com/advisories/ajenti-remote-code-execution. Security practitioners should consult these for upgrade instructions and remediation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30913
Vulnerability details
Ajenti 2.1.36 contains a post-authenticated remote command execution vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of a public-facing web application (Ajenti panel) for unauthenticated remote command execution via OS command injection in a Unix/Linux environment.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces authorization checks on the /api/terminal/create endpoint so that only authenticated and authorized sessions can invoke command execution.
Requires validation and sanitization of all input supplied to the terminal API, directly blocking OS command injection payloads such as netcat reverse shells.
Restricts the privileges of the Ajenti process and authenticated users so that even a successful terminal invocation cannot easily escalate to full system RCE.