CVE-2020-5242

Name of the Vulnerable Software and Affected Versions openHAB versions prior to 2.5.2

Description The issue allows a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2, all commands need to be whitelisted in a local file which cannot be changed via REST calls.

Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later to ensure that commands are whitelisted in a local file and cannot be changed via REST calls. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.