CVE-2020-8810

An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed.

• CWE-22

• https://github.com/seqred-s-a/gxdlmsdirector-cveExploit, Third Party Advisory
• https://seqred.pl/en/cve-gurux-gxdlms-director/Third Party Advisory
• https://github.com/seqred-s-a/gxdlmsdirector-cveExploit, Third Party Advisory
• https://seqred.pl/en/cve-gurux-gxdlms-director/Third Party Advisory

Published

Feb 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8803SuiteCRM through 7.11.11 allows Directory Traversal to inclu…9.8
• CVE-2020-8804SuiteCRM through 7.11.10 allows SQL Injection via the SOAP A…6.5
• CVE-2020-8806Electric Coin Company Zcashd before 2.1.1-1 allows attackers…7.5
• CVE-2020-8807In Electric Coin Company Zcashd before 2.1.1-1, the time off…5.3
• CVE-2020-8808The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers …7.8
• CVE-2020-8809Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updat…8.1
• CVE-2020-8811ajax/profile-picture-upload.php in Bludit 3.10.0 allows auth…4.3
• CVE-2020-8812Bludit 3.10.0 allows Editor or Author roles to insert malici…5.4
• CVE-2020-8813graph_realtime.php in Cacti 1.2.8 allows remote attackers to…8.8
• CVE-2020-8815Improper connection handling in the base connection handler …7.5
• CVE-2020-8816Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Executi…7.2
• CVE-2020-8817Dataiku DSS before 6.0.5 allows attackers write access to th…8.1