CVE-2020-13167: Netsweeper unauthenticated OS command injection in unixlogin.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score and very high EPSS probability, with public exploit references available.

What it is

Netsweeper through 6.4.3 contains an OS command injection flaw in webadmin/tools/unixlogin.php. The script launches a command line using client-supplied parameters and fails to neutralize shell metacharacters, so an unauthenticated remote attacker can execute arbitrary commands. Because the endpoint is reachable without credentials and the impact spans confidentiality, integrity and availability, this is a severe pre-auth RCE.

Impact

An attacker gains remote code execution with the privileges of the web server process, allowing full compromise of the Netsweeper host and any data or downstream systems it can reach.

Attack surface

Reachable over the network via HTTP requests to webadmin/tools/unixlogin.php, with certain Referer headers required. No authentication and no user interaction are needed per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.954 probability, 99.9th percentile) and both references are tagged Exploit, indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade Netsweeper past 6.4.3 to a fixed release; confirm the vendor's patched version before deploying.
• If patching is not immediately possible, block or restrict external access to webadmin/tools/unixlogin.php and the webadmin interface at the network or reverse-proxy layer.
• Require authentication and network-level access controls for all administrative web endpoints.
• Monitor and restrict outbound traffic from the Netsweeper host to limit post-exploitation movement.
• Review the host for signs of compromise and rotate credentials if exploitation is suspected.

Detection

• Inspect web server and proxy logs for requests to webadmin/tools/unixlogin.php, especially with unusual Referer headers or shell metacharacters in parameters.
• Alert on command-shell child processes spawned by the web server user (for example sh, bash, curl, wget) on Netsweeper hosts.
• Monitor for unexpected outbound connections or file writes originating from the Netsweeper web process.
• Correlate repeated or anomalous requests to the webadmin path with process creation telemetry on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.