CVE-2020-7980

CriticalPublished

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a...

Published: Jan 25, 2020
Updated: Aug 4, 2024
Assigning CNA: mitre
Evidence observed: Jan 29, 2020

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

82.5%

High · next 30 days

Percentile: 99.7%
Model date: Oct 14, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

Satellian Intellian Aptus Web <= 1.24 - Remote Command ExecutionTemplate
http/cves/2020/CVE-2020-7980.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 3de629d823bbRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: regex,status($.matchers[*].type)

Satellian-CVE-2020-7980PoC
PoC script that shows RCE vulnerability over Intellian Satellite controller
Satellian 1.12 - Remote Code Execution

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.