Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-14947: OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishan...

CVE-2020-14947 · published 6 years ago

Summary

OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
factorfx	open_computer_software_inventory_next_generation	2.7 `cpe:2.3:a:factorfx:open_computer_software_inventory_next_generation:2.7:::::::*`

Original advisory text

References

http://packetstormsecurity.com/files/158293/OCS-Inventory-NG-2.7-Remote-Code-Exe... Exploit Third Party Advisory VDB Entry
https://drive.google.com/file/d/1-LVfL5ui5m2QfQxr0fDopzSECd4fTNrQ/view?usp=shari... Exploit Third Party Advisory
https://gist.github.com/mhaskar/233436d3096d4a7beafe36ff61dc2c73 Exploit Third Party Advisory
https://github.com/OCSInventory-NG/OCSInventory-ocsreports/commit/da72e0fddaecee... Patch Third Party Advisory
https://shells.systems/ocs-inventory-ng-v2-7-remote-command-execution-cve-2020-1... Exploit Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

19% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published30 Jun 2020

Updated29 Sep 2026

First seen29 Sep 2026

Sources

CVE-2020-14947 · NVD

Track software like this

Free during beta