PT-2020-15942 · Logrhythm · Logrhythm Smart Response+1

Published 2020-12-17 · Updated 2021-07-21 · CVE-2020-25094

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LogRhythm Platform Manager version 7.4.9

Description The issue allows for Command Injection, where an attacker can inject arbitrary program names and arguments into a WebSocket. These commands are then forwarded to any remote server with a LogRhythm Smart Response agent installed, running with LocalSystem privileges by default.

Recommendations For LogRhythm Platform Manager version 7.4.9, consider disabling the WebSocket functionality until a patch is available to prevent command injection attacks. Restrict access to the LogRhythm Smart Response agent to minimize the risk of exploitation. Avoid using the vulnerable version of the LogRhythm Platform Manager until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-25094

Affected Products

Logrhythm Platform Manager

Logrhythm Smart Response

References · 6

• 🔥 https://cybercx.com.au/blog/2020/12/15/logrhythm-zero-days · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25094 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25094 · Vendor Advisory
• https://t.me/cibsecurity/20982 · Telegram Post
• https://t.me/cvenotify/7448 · Telegram Post
• https://t.me/cybersecuritytechnologies/2369 · Telegram Post