CVE-2020-13167

Name of the Vulnerable Software and Affected Versions Netsweeper versions prior to 6.4.4

Description The issue allows unauthenticated remote code execution. This is possible because the webadmin/tools/unixlogin.php endpoint, when provided with certain Referer headers, launches a command line with client-supplied parameters. It also allows the injection of shell metacharacters.

Recommendations For versions prior to 6.4.4, update to version 6.4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the webadmin/tools/unixlogin.php endpoint to minimize the risk of exploitation. Avoid using this endpoint with untrusted input until the issue is resolved.