CVE-2020-12775 CRITICAL

CVE-2020-12775: Hicos citizen certificate client-side component - Command Injection

Vendor Hicos
Product citizen certificate client-side component
Weakness CWE-78
Published March 1, 2022
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system command, disrupt system or terminate service.

Key dates

02Disclosure timeline

March 1, 2022 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-41675 Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization CVE-2026-9532 Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection CVE-2023-41193 D-Link DAP-1325 HNAP SetAPLanSettings SecondaryDNS Command Injection Remote Code Execution Vulnerability CVE-2025-10326 MiczFlor RPi-Jukebox-RFID single.php os command injection CVE-2026-8230 Wavlink NU516U1 login.cgi sys_login1 os command injection