CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2020-7209Public Exploit

LinuxKI - RCE (CVE-2020-7209)

PublishedFeb 12, 2020
First SeenMay 28, 2025
Last Seen
Reported
CVSS9.8
HP
HPLinuxKI

Description

LinuxKI v6.0-1 and earlier is vulnerable to a remote code execution which is resolved in release 6.0-2.

psychologyCrowdSec Analysis

CVE-2020-7209 is a critical remote code execution vulnerability affecting LinuxKI, allowing attackers to execute arbitrary commands via crafted requests to a diagnostic interface.

CrowdSec has been tracking this vulnerability and its exploits since 27th of May 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-7209 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2020-7209 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts are focused on URLs containing /linuxki/experimental/vis/kivis.php.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2020-02-12
Rule Released2025-05-27
CrowdSec First Seen2025-05-28

Related Weaknesses

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References