CVE-2020-25136

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-09-25 · updated 2026-06-17
Weakness: CWE-22

Description

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=routing&proto=../ URIs to device/routing.inc.php.

Affected products

Observium: 20.8.10631

References

https://gist.github.com/mariuszpoplawski/5ae335a080ba40996d4020181759e02f
https://gist.github.com/mariuszpoplawski/5ae335a080ba40996d4020181759e02f

Get alerted when CVE-2020-25136 or the next vulnerability affects your stack