Security readout for executives and security teams
Plain-English summary
CVE-2020-22120 is an authenticated remote code execution issue reported in imcat v5.1. A logged-in attacker could execute arbitrary code through an admin-related endpoint. The sources do not provide CVSS scoring, vendor-fixed versions, or confirmed real-world exploitation evidence.
Executive priority
Prioritize discovery and containment where imcat v5.1 is internet-facing or broadly accessible to authenticated users. Business urgency is elevated because the reported impact is arbitrary code execution, but confidence is limited by sparse public metadata.
Technical view
The CVE describes RCE in `/root/run/adm.php?admin-ediy&part=exdiy` in imcat v5.1. The referenced CWE-96 indicates improper neutralization of directives in statically saved code. Public metadata is sparse, with no CVSS vector, CPE, patch detail, or complete affected-product mapping supplied.
Likely exposure
Exposure is likely limited to organizations running imcat v5.1, especially where the admin endpoint is reachable by authenticated users. The source bundle lists affected product fields as unavailable, so asset confirmation must rely on local inventories and application fingerprints.
Exploitation context
The CVE is not listed as KEV in the supplied data, and the bundle does not cite active exploitation. The GitHub issue reference indicates public disclosure, but the provided bundle does not establish exploitation in the wild.
Researcher notes
Do not assume broader imcat versions or forks are affected without evidence. The useful leads are the specific admin endpoint, imcat v5.1, authenticated attacker requirement, and CWE-96 classification. Patch status and exploit maturity are not established in the supplied sources.
Mitigation direction
- Identify any imcat v5.1 deployments before prioritizing changes.
- Check imcat upstream guidance for fixed versions or supported remediation.
- Restrict admin endpoint access to trusted networks and administrators.
- Review admin accounts and remove unnecessary authenticated access.
- Monitor affected hosts for unexpected code or file changes.
Validation and detection
- Inventory web applications for imcat v5.1 usage.
- Confirm whether `/root/run/adm.php` is reachable from untrusted networks.
- Review access logs for unusual authenticated admin activity.
- Check whether vendor or maintainer guidance names a fixed release.
- Inspect affected systems for unauthorized code modifications.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-22120 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/peacexie/imcat/issues/3CVE reference · x_refsource_MISC
- https://cwe.mitre.org/data/definitions/96.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.