CVE-2020-37002: Ajenti 2.1.36 Post-Authentication OS Command Injection (CWE-78)
Ajenti 2.1.36 is associated with a post-authenticated OS command injection flaw (CWE-78) that can let a logged-in user run arbitrary commands on the host. The record reports a CVSS 3.1 base score of 9.8 (critical) and a CVSS 4.0 score of 8.7, both from VulnCheck. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Overview
Ajenti 2.1.36 is reported to contain a post-authenticated remote command execution flaw, classified as OS command injection (CWE-78). The record describes it as requiring a successful login before it can be triggered. The CVE was published on 2026-01-29 and its source status is listed as Deferred.
Impact
- A user who can reach the Ajenti interface and authenticate may be able to execute arbitrary commands on the host.
- The record gives a CVSS 3.1 base score of 9.8 (critical) from VulnCheck, and a CVSS 4.0 score of 8.7.
- Successful command execution would allow changes to the host, access to data it stores, and use of the host for further activity.
Affected products and versions
The record names Ajenti 2.1.36 in its description. It contains no structured list of affected products, version ranges or fixed versions, so the full scope is unknown. Other versions may be affected, and the absence of a fixed version does not mean that no fix exists. Check the upstream project at https://github.com/ajenti/ajenti for current release information.
Exploitation status
The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted. The record references an Exploit-DB entry, which shows public exploit material exists, but this does not establish exploitation in the wild.
Remediation and mitigation
- Identify every Ajenti instance in your environment and confirm whether any runs version 2.1.36.
- Restrict access to the administrative interface to trusted networks, such as a VPN or management segment.
- Enforce strong, unique credentials and multi-factor authentication where supported, to reduce the chance of an attacker obtaining a valid login.
- Run the service with least privilege and isolate it from sensitive systems.
- Monitor the VulnCheck advisory and the upstream project for an official fix, and apply it as soon as it is available.
Detection guidance
- Review authentication logs for unexpected logins, especially from unfamiliar sources or at unusual times.
- Look for unexpected child processes spawned by the Ajenti service account.
- Watch for outbound network connections from the server to unfamiliar addresses or unusual ports.
- Alert on activity against terminal-related management functions from accounts or sources that do not normally use them.
Limitations of the available information
- No fixed version, affected version range or vendor patch is present in the record.
- EPSS and SSVC data are not available, so exploitation likelihood cannot be scored from the record.
- The CVSS 3.1 vector marks privileges required as none (PR:N), which appears inconsistent with the description of a post-authenticated flaw. This should be verified against the vendor or upstream project.
- The source status is Deferred, so the record may change.
- The title field was empty in the record, so the title here is derived from the description.
Frequently asked questions
Does this vulnerability require authentication?
The record describes it as post-authenticated, meaning a successful login is needed. However, the CVSS 3.1 vector lists privileges required as none, which conflicts with that description and should be verified with the vendor or upstream project.
Is CVE-2020-37002 being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted. A public exploit entry is referenced, but that does not establish exploitation in the wild.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.