PT-2025-54418 · Selea · Selea Carplateserver

Published 2025-12-31 · Updated 2025-12-31 · CVE-2020-36904

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Selea CarPlateServer version 4.0.1.6

Description An issue allows attackers to execute arbitrary Windows binaries by manipulating the NO LIST EXE PATH configuration parameter. Authentication can be bypassed via the '/cps/' endpoint, enabling unauthorized modification of server configurations, such as changing administrator passwords and executing system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-36904

Affected Products

Selea Carplateserver

References · 5

• 🔥 https://exploit-db.com/exploits/49452 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36904 · Security Note
• https://selea.com · Note
• https://vulncheck.com/advisories/selea-carplateserver-remote-program-execution-via-configuration-endpoint · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2021-5622.php · Note