Platform
java
Component
aircontrol
Fixed in
1.4.3
CVE-2020-37052 describes a critical pre-authentication Remote Code Execution (RCE) vulnerability present in Rohos AirControl versions up to 1.4.2. This flaw allows an attacker to execute arbitrary system commands on the server without requiring authentication. Exploitation occurs through the /.seam endpoint by injecting malicious Java expressions, granting the attacker system-level privileges. A patch is available to address this vulnerability.
The impact of CVE-2020-37052 is severe. A successful exploit allows an unauthenticated attacker to gain complete control over the Rohos AirControl server. This can lead to data breaches, system compromise, and potential lateral movement within the network. Attackers could install malware, steal sensitive information, or disrupt services. The lack of authentication required for exploitation significantly broadens the attack surface, making this vulnerability particularly dangerous. The ability to execute arbitrary commands with system privileges grants the attacker the highest level of access, enabling them to perform virtually any action on the compromised system.
CVE-2020-37052 is a highly concerning vulnerability due to its ease of exploitation and critical impact. Public proof-of-concept (PoC) code is likely to emerge given the vulnerability's nature. While no active exploitation campaigns have been definitively confirmed, the severity and simplicity of exploitation suggest a high probability of exploitation. The vulnerability was publicly disclosed on 2026-01-30. It is recommended to prioritize remediation efforts.
Exploit Status
EPSS
0.18% (40% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2020-37052 is to upgrade Rohos AirControl to a patched version. Rohos has released updates to address this vulnerability; consult their official advisory for the latest version. If immediate patching is not possible, consider implementing temporary workarounds such as restricting access to the /.seam endpoint through a Web Application Firewall (WAF) or proxy server. Carefully review and restrict Java execution permissions within the AirControl environment. Monitor system logs for suspicious activity related to the /.seam endpoint, looking for unusual Java execution patterns. After upgrading, confirm the vulnerability is resolved by attempting to access the /.seam endpoint with a crafted Java expression; it should be rejected.
Actualice AirControl a una versión posterior a 1.4.2 para corregir la vulnerabilidad de ejecución remota de código. Consulte el sitio web del proveedor (Ubiquiti) para obtener la última versión y las instrucciones de actualización.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2020-37052 is a critical RCE vulnerability in Rohos AirControl versions up to 1.4.2, allowing unauthenticated attackers to execute commands.
You are affected if you are running Rohos AirControl version 1.4.2 or earlier. Upgrade immediately to a patched version.
Upgrade to the latest patched version of Rohos AirControl. Consult the official Rohos advisory for details.
While no confirmed active exploitation campaigns are publicly known, the vulnerability's severity and ease of exploitation suggest a high probability of exploitation.
Refer to the Rohos Security website and their official security advisories for the latest information and patch details.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your pom.xml file and we'll tell you instantly if you're affected.