CVE-2020-14947: OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/Comman...

Security readout for executives and security teams

OCS Inventory NG 2.7 has a remote command execution flaw tied to mishandling of an SNMP MIB file value. If an exposed or reachable deployment includes the vulnerable code path, an attacker may be able to run commands on the server. The sources do not show CISA KEV listing or confirmed active exploitation. Exposure is most likely for organizations running OCS Inventory NG 2.7, especially where OCS reports or SNMP configuration functionality is reachable by untrusted users or networks. The provided affected-product metadata is incomplete, so confirm deployed version and code state directly. Treat this as a high-priority server-side RCE risk if OCS Inventory NG 2.7 is deployed. Prioritize exposed management servers first, then internal-only systems with broad user access. Mitigation focus: Inventory all OCS Inventory NG deployments and confirm whether version 2.7 is present.; Review OCS Inventory guidance and apply the vendor fix associated with the referenced commit.; Restrict access to OCS Inventory administrative and SNMP configuration functions..

Prepared

Jun 5, 2026, 14:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.