CVE-2020-5847

Unraid versions through 6.8.0 are vulnerable to unauthenticated remote code execution: an attacker with network access to the server's web management interface can bypass authentication and execute arbitrary code with root privileges. The attack requires no credentials, special conditions, or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), so any internet-exposed or otherwise reachable Unraid server is directly exploitable. Successful exploitation gives an attacker full root-level control of the server, enabling data theft, malware or ransomware deployment, and persistence on the host. All Unraid deployments up to and including 6.8.0 are affected. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), public proof-of-concept exploits have been available since February 2020, and EPSS assigns a ~96% probability of exploitation in the next 30 days; ransomware-specific use is currently unknown.

What to do: Upgrade all Unraid servers to a release newer than 6.8.0 per vendor instructions, as required by the CISA KEV catalog. Until patched, restrict the Unraid web management interface to trusted networks (VPN or firewall rules) and do not expose it directly to the internet. Because exploitation yields root access, review patched-but-previously-exposed servers for signs of compromise such as unexpected processes, new user accounts or cron entries, and unfamiliar outbound connections.