CVE-2020-24046

A sandbox escape issue was discovered in TitanHQ SpamTitan Gateway 7.07. It limits the admin user to a restricted shell, allowing execution of a small number of tools of the operating system. This restricted shell can be bypassed after changing the properties of the user admin in the operating system file /etc/passwd. This file cannot be accessed though the restricted shell, but it can be modified by abusing the Backup/Import Backup functionality of the web interface. An authenticated attacker would be able to obtain the file /var/tmp/admin.passwd after executing a Backup operation. This file can be manually modified to change the GUID of the user to 0 (root) and change the restricted shell to a normal shell /bin/sh. After the modification is done, the file can be recompressed to a .tar.bz file and imported again via the Import Backup functionality. The properties of the admin user will be overwritten and a root shell will be granted to the user upon the next successful login.

• CWE-269

• https://github.com/felmoltorThird Party Advisory
• https://sensepost.com/blog/2020/clash-of-the-spamtitan/Exploit, Third Party Advisory
• https://twitter.com/felmoltorThird Party Advisory
• https://www.titanhq.comVendor Advisory
• https://github.com/felmoltorThird Party Advisory
• https://sensepost.com/blog/2020/clash-of-the-spamtitan/Exploit, Third Party Advisory
• https://twitter.com/felmoltorThird Party Advisory
• https://www.titanhq.comVendor Advisory

Published

Sep 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24032tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances…9.8
• CVE-2020-24033An issue was discovered in fs.com S3900 24T4S 1.7.0 and earl…8.8
• CVE-2020-24034Sagemcom F@ST 5280 routers using firmware version 1.150.61 h…8.8
• CVE-2020-24036PHP object injection in the Ajax endpoint of the backend in …8.8
• CVE-2020-24038myFax version 229 logs sensitive information in the export l…6.5
• CVE-2020-24045A sandbox escape issue was discovered in TitanHQ SpamTitan G…7.2
• CVE-2020-24051The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the…9.8
• CVE-2020-24052Several XML External Entity (XXE) vulnerabilities in the Moo…9.1
• CVE-2020-24053Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcode…7.5
• CVE-2020-24054The administration console of the Moog EXO Series EXVF5C-2 a…9.8
• CVE-2020-24055Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23,…9.8
• CVE-2020-24056A hardcoded credentials vulnerability exists in Verint 5620P…7.5