CVE-2020-8868: Quest Foglight Evolve CommandLineService Use of Hard-coded Credentials Remote Code Execution Vulnerability
First published: Mon Mar 23 2020(Updated: )
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the __service__ user account. The product contains a hard-coded password for this account. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-9553.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Quest Foglight Evolve | ||
| Quest Foglight Evolve | =9.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-8868?
The severity of CVE-2020-8868 is critical with a CVSS score of 9.8.
How does CVE-2020-8868 impact Quest Foglight Evolve?
CVE-2020-8868 allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0.
Is authentication required to exploit CVE-2020-8868?
No, authentication is not required to exploit CVE-2020-8868.
What is the affected software for CVE-2020-8868?
The affected software is Quest Foglight Evolve version 9.0.0.
Are there any available references related to CVE-2020-8868?
Yes, you can find more information at the following references: [Link 1](https://support.quest.com/foglight/kb/315091/fms-5-9-5-hotfix-hfix-314), [Link 2](https://www.zerodayinitiative.com/advisories/ZDI-20-290/).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/tags
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-290
- alias/ZDI-CAN-9553
- alias/CVE-2020-8868
- agent/software-canonical-lookup
- vendor/quest
- canonical/quest foglight evolve
- version/quest foglight evolve/9.0.0