CVE-2020-25094

PoC —

CVSS 3.1

9.8 critical

EPSS

3%p87

Published

Dec 17, 2020 (Dec 17, 2020)

Modified

Jun 17, 2026

Description

LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default, the commands are run with LocalSystem privileges.

Vendors: logrhythm
Products: platform manager
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.1%)

In the news0 stories

No ingested article mentions this CVE yet.