CVE-2020-15492

An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal, or possibly have unspecified other impact.

• CWE-22

• http://packetstormsecurity.com/files/158556/INNEO-Startup-TOOLS-2018-M040-13.0.70.3804-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://www.inneo.co.uk/en/product-development/inneo-in-house-products/startup-tools.htmlProduct, Vendor Advisory
• https://www.inneo.de/files/content/Produktentwicklung/Tools-und-Erweiterungen/Startup-TOOLS/INNEO-SA-SUT-2020-01.pdfVendor Advisory
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-028.txtExploit, Third Party Advisory
• https://www.syss.de/pentest-blog/2020/syss-2020-028-sicherheitsschwachstelle-in-inneo-startup-tools-2017-und-2018/Third Party Advisory
• http://packetstormsecurity.com/files/158556/INNEO-Startup-TOOLS-2018-M040-13.0.70.3804-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://www.inneo.co.uk/en/product-development/inneo-in-house-products/startup-tools.htmlProduct, Vendor Advisory
• https://www.inneo.de/files/content/Produktentwicklung/Tools-und-Erweiterungen/Startup-TOOLS/INNEO-SA-SUT-2020-01.pdfVendor Advisory
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-028.txtExploit, Third Party Advisory
• https://www.syss.de/pentest-blog/2020/syss-2020-028-sicherheitsschwachstelle-in-inneo-startup-tools-2017-und-2018/Third Party Advisory

Published

Jul 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15486An issue was discovered on Dr Trust ECG Pen 2.00.08 devices.…6.5
• CVE-2020-15487Re:Desk 2.3 contains a blind unauthenticated SQL injection v…9.8
• CVE-2020-15488Re:Desk 2.3 allows insecure file upload.7.5
• CVE-2020-15489An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.…9.8
• CVE-2020-1549An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15490An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.…9.8
• CVE-2020-15495Acronis True Image 2019 update 1 through 2020 on macOS allow…7.8
• CVE-2020-15496Acronis True Image for Mac before 2021 Update 4 allowed loca…7.8
• CVE-2020-15497jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-2020…6.1
• CVE-2020-15498An issue was discovered on ASUS RT-AC1900P routers before 3.…5.9
• CVE-2020-15499An issue was discovered on ASUS RT-AC1900P routers before 3.…6.1
• CVE-2020-1550An elevation of privilege vulnerability exists when the Wind…7.8