CVE-2020-8233

HIGH

8.8

CVSS Score

Published: August 17, 2020 at 03:41 PM UTC

Updated: June 17, 2026 at 03:26 AM UTC

15 products affected across 2 vendorsLeapBackports SleEdgeswitch Firmware

Using EdgeSwitch firmware v1.9.0 and prior by N/A?

Get instant alerts when new vulnerabilities affect EdgeSwitch firmware v1.9.0 and prior - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 4%

Description

A command injection vulnerability exists in EdgeSwitch firmware <v1.9.0 that allowed an authenticated read-only user to execute arbitrary shell commands over the HTTP interface, allowing them to escalate privileges.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Backports Sle · openSUSE

95%

15.0 sp1 15.0 sp2

Leap · openSUSEdrupal

95%

15.1 15.2

Edgeswitch Firmware · UI

95%

v < 1.9.0

Affected range stops below 1.9.0, so it looks safe — our inference, not a vendor statement

ui-ep-16-xg (environment) · ui-ep-s16 (environment) · ui-es-12f (environment) · ui-es-16-150w (environment) · ui-es-24-250w (environment) · ui-es-24-500w (environment) · ui-es-24-lite (environment) · ui-es-48-500w (environment) · ui-es-48-750w (environment) · ui-es-48-lite (environment) · ui-es-8-150w (environment)

Edgeswitch · UI

60%

Fixed version EdgeSwitch firmware v1.9.1

Ep-16-Xg · UIdevice

80%

All versions

Ep-S16 · UIdevice

80%

All versions

Es-12F · UIdevice

80%

All versions