CVE-2020-37027

CriticalPublic PoCRCE

Published: 30 January 2026

Published

30 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0226 80.7th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2020-37027 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 19.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2020-37027 is a remote command injection vulnerability (CWE-78) in Sickbeard alpha, an open-source TV show management application. The flaw resides in the extra scripts configuration, where attackers can inject and execute arbitrary commands on the server hosting the vulnerable Sickbeard installation.

Unauthenticated remote attackers can exploit this vulnerability by submitting malicious commands via the extra scripts field and triggering the processing mechanism, resulting in arbitrary remote code execution. The CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects its critical severity, with low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.

Advisories and references, including the VulnCheck advisory on Sickbeard remote command injection, the Sick-Beard GitHub repository, an archived Sickbeard website, and an Exploit-DB entry (exploit 48646), document the issue but do not specify patches or mitigations in the available details. A public proof-of-concept exploit is available on Exploit-DB, underscoring the risk for internet-exposed Sickbeard instances.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2020-30949

Vulnerability details

Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can set malicious commands in the extra scripts field and trigger processing to execute remote code on the…

vulnerable Sickbeard installation.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Unauthenticated remote command injection in a public-facing TV show management application (Sickbeard) enables exploitation of public-facing applications (T1190) and facilitates arbitrary OS command execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0