CVE-2020-8868: Quest Foglight Evolve CommandLineService Use of Hard-coded Credentials Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the service user account. The product contains a hard-coded password for this account. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-9553.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8868?
The severity of CVE-2020-8868 is critical with a CVSS score of 9.8.
How does CVE-2020-8868 impact Quest Foglight Evolve?
CVE-2020-8868 allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0.
Is authentication required to exploit CVE-2020-8868?
No, authentication is not required to exploit CVE-2020-8868.
What is the affected software for CVE-2020-8868?
The affected software is Quest Foglight Evolve version 9.0.0.
Are there any available references related to CVE-2020-8868?
Yes, you can find more information at the following references: [Link 1](https://support.quest.com/foglight/kb/315091/fms-5-9-5-hotfix-hfix-314), [Link 2](https://www.zerodayinitiative.com/advisories/ZDI-20-290/).