CVE Intelligence
Analysis AI-assisted

CVE-2020-37123: Pinger 1.0 OS Command Injection Leading to Remote Code Execution

Pinger 1.0 is affected by an OS command injection flaw (CWE-78) that the record says allows remote code execution through the ping and socket parameters. The CVSS 3.1 base score of 9.8 (critical) comes from VulnCheck, and CISA KEV does not list this CVE. The record has no structured affected or fixed version data, so remediation status is unknown.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a remote code execution issue in Pinger 1.0 caused by OS command injection (CWE-78). According to the description, the ping and socket parameters are not sanitized before reaching ping.php.

Impact

  • The description states that an attacker could run system commands on the server and write arbitrary PHP files.
  • The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates, per the scoring, network reachability, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity and availability.
  • A CVSS 4.0 score of 9.3 is also listed by the same provider.

Affected products and versions

  • The product named in the description is Pinger 1.0.
  • The record contains no structured affected or fixed version data.
  • The project repository is listed at github.com/wcchandler/pinger.

Exploitation status

The CVE is not listed in CISA KEV in this record. No confirmed exploitation in the wild appears in the sources consulted. An Exploit-DB entry is listed among the references, but the record does not establish how it has been used.

Remediation and mitigation

  • Identify whether Pinger 1.0 is deployed in your environment, especially any instance reachable from the internet.
  • No vendor fix is identified in the record. Treat the absence of a listed fix as unknown, not as proof that no fix exists.
  • Restrict or remove access to the affected application until an authoritative remediation is confirmed.
  • Validate input strictly and avoid passing user-supplied values to operating system shells.
  • Run the web application with least privilege and restrict write permissions for the web server account.

Detection guidance

  • Review web server logs for requests to ping.php that contain unusual parameter values or shell metacharacters.
  • Monitor web-accessible directories for unexpected new PHP files.
  • Watch for web server processes that spawn unexpected child processes.

Limitations of the available information

  • The record has no structured affected version range, fixed version or vendor advisory.
  • EPSS and SSVC data are not available.
  • The CVSS scores are attributed to the CNA disclosure@vulncheck.com in the record.

Frequently asked questions

What is CVE-2020-37123?

It is a reported OS command injection flaw in Pinger 1.0 that the record says allows remote code execution through the ping and socket parameters.

Is this CVE known to be actively exploited?

CISA KEV does not list it in this record, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.