AirControl 1.4.2 - PreAuth Remote Code Execution

The impact of CVE-2020-37052 is severe. A successful exploit allows an unauthenticated attacker to gain complete control over the Rohos AirControl server. This can lead to data breaches, system compromise, and potential lateral movement within the network. Attackers could install malware, steal sensitive information, or disrupt services. The lack of authentication required for exploitation significantly broadens the attack surface, making this vulnerability particularly dangerous. The ability to execute arbitrary commands with system privileges grants the attacker the highest level of access, enabling them to perform virtually any action on the compromised system.

Organizations utilizing Rohos AirControl for secure file transfer and remote access are at significant risk. This includes businesses relying on AirControl for internal data sharing and those providing remote access to clients or partners. Environments with limited security controls or those lacking robust WAF configurations are particularly vulnerable.

• java / server:

find / -name "*.jar" -exec grep -i '\.seam' {} \;

• java / server:

ps aux | grep -i '/.seam'

• generic web: Use a WAF or proxy to monitor and block requests to the /.seam endpoint, especially those containing unusual characters or patterns indicative of Java expression injection.

1. 2026-01-30Disclosure

   disclosure

1. Reserviert2026-01-28
2. Veröffentlicht2026-01-30
3. Geändert2026-02-02
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2020-37052 is to upgrade Rohos AirControl to a patched version. Rohos has released updates to address this vulnerability; consult their official advisory for the latest version. If immediate patching is not possible, consider implementing temporary workarounds such as restricting access to the /.seam endpoint through a Web Application Firewall (WAF) or proxy server. Carefully review and restrict Java execution permissions within the AirControl environment. Monitor system logs for suspicious activity related to the /.seam endpoint, looking for unusual Java execution patterns. After upgrading, confirm the vulnerability is resolved by attempting to access the /.seam endpoint with a crafted Java expression; it should be rejected.