Is there a public PoC exploit available for CVE-2020-37002?

Yes, a public proof-of-concept exploit is available for CVE-2020-37002. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2020-37002?

Within 24 hours: Identify and inventory all Ajenti 2.1.36 instances across the organization and isolate them from production networks if possible; disable external access to the /api/terminal/create endpoint via firewall rules. Within 7 days: Implement network segmentation to restrict access to Ajenti systems to authorized administrators only; deploy WAF rules to block malicious payloads targeting the vulnerable endpoint; review access logs for indicators of exploitation. Within 30 days: Upgrade to Ajenti version 2.2.0 or later once patches are released and validated; conduct forensic analysis of affected systems to identify any unauthorized access or command execution.

CVE-2020-37002

Q: What is the CVSS score of CVE-2020-37002?

CVE-2020-37002 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

HIGH

OS Command Injection (CWE-78)

2026-01-29 disclosure@vulncheck.com

Authentication Bypass Command Injection

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 26, 2026 - 00:22 vuln.today

cvss_changed

Severity Changed

May 26, 2026 - 00:22 NVD

CRITICAL HIGH

CVSS changed

May 26, 2026 - 00:22 NVD

9.8 (CRITICAL) 8.7 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Jan 29, 2026 - 16:31 vuln.today

Public exploit code

CVE Published

Jan 29, 2026 - 15:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Ajenti 2.1.36 contains an authentication bypass vulnerability that allows remote attackers to execute arbitrary commands after successful login. Attackers can leverage the /api/terminal/create endpoint to send a netcat reverse shell payload targeting a specified IP and port.

AnalysisAI

Authentication bypass leading to command execution in Ajenti 2.1.36. Despite requiring login, the authentication can be bypassed for subsequent command execution. EPSS 0.64% with PoC available.