CVE-2020-25094

LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges.

• CWE-78

• https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/Exploit, Third Party Advisory
• https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days/Exploit, Third Party Advisory

Published

Dec 17, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25089Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS…6.1
• CVE-2020-2509A command injection vulnerability has been reported to affec…9.8
• CVE-2020-25090Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS…6.1
• CVE-2020-25091Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS…6.1
• CVE-2020-25092Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS…6.1
• CVE-2020-25093Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS…6.1
• CVE-2020-25095LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web i…8.8
• CVE-2020-25096LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access C…8.8
• CVE-2020-25097An issue was discovered in Squid through 4.13 and 5.x throug…8.6
• CVE-2020-2510Vulnerability in the Core RDBMS component of Oracle Database…7.5
• CVE-2020-25102silverstripe-advancedreports (aka the Advanced Reports modul…6.1
• CVE-2020-25104eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a…5.4