CVE-2020-5632

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-06 · updated 2026-06-17

Description

InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1) allow authenticated attackers to bypass access restriction and to execute arbitrary code with an elevated privilege via a specially crafted executable files.

Affected products

NEC Corporation InfoCage SiteShell series: before 2.0.0.6; from 2.0.0.0 before 2.0.0.6; from 2.1.0.0 before 2.1.0.7; from 2.1.1.0 before 2.1.1.6; from 3.0.0.0 before 3.0.0.11; from 4.0.0.0 before 4.0.0.6 — fixed in 2.0.0.6, 2.1.0.7, 2.1.1.6, 3.0.0.11, 4.0.0.6, 4.1.0.5

How to fix

Upgrade to a fixed version: NEC Corporation InfoCage SiteShell series 2.0.0.6, 2.1.0.7, 2.1.1.6, 3.0.0.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-5632 or the next vulnerability affects your stack